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Report  Summary 


Introduction 

This  report  describes  the  research  efforts  carried  out 
under  Air  Force  Contract  F30602-80-C-0200.  The  purpose  of  the 
research  was  to  develop  techniques  for  the  self-testing  of 
microprocessors.  These  techniques  were  then  implemented  for  a 
specific,  8080  based  microcomputer  system.  The  implementation 
took  the  form  of  a  set  of  self-test  routines  and  a  small  amount 
of  added,  self-test  hardware.  In  order  to  assess  the 
effectiveness  of  the  self-test  software,  a  "chip"  level 
simulation  model  was  developed  and  used  to  simulate  faults  in 
the  systems  and  thus  rate  the  effectiveness  of  the  self-test 
software.  Finally,  a  real  8080  system  was  built  and  the  self¬ 
test  software  executed  on  it  in  order  to  demonstrate  its 
compatibility  with  a  real  time  computer  system  environment. 
Self-Test  Techniques 

The  report  describes  one  program  in  a  proposed  library  of 
self-test  programs  for  microprocessor  based  systems.  The 
library  is  to  contain  a  set  of  programs  with  varying  degrees  of 
fault  coverage  and  execution  times.  This  report  describes  a 
self-test  designed  for  minimum  execution  time,  minimum  use  of 
added  hardware,  and  minimum  interference  with  the  main  system 
tasks.  Within  these  constraints,  maximum  fault  coverage  is 
desired. 

The  basic  approach  was  to  partition  the  self-test  program 
into  segments  that  require  from  2  to  4  milliseconds  each  to 
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execute.  A  timer  is  used  to  generate  program  interrupts  at  a 

i 

frequency  selected  by  the  user  (e.g.,  every  two  seconds).  Each 
interrupt  causes  execution  of  the  next  self- test  segment.  The 
CPU  test  and  parallel  I/O  port  test  both  execute  in  the  first 
segment.  Memory  tests  posed  the  greatest  demand  upon  execution 
time.  Only  128  bytes  of  ROM  or  32  bytes  of  RAM  can  be  tested  in 
the  2-4  ms  window.  Thus  memory  testing  is  carried  out  in  a 
series  of  segments.  Serial  I/O  port  tests  require  2  segments  at 
9600  Baud. 

A  second  timer  is  used  to  insure  that  the  interrupt  request 
is  acknowledged  within  a  reasonable  time.  Once  the  interrupt  is 
acknowledged,  a  timer  is  set  for  2-4  ms,  depending  upon  the 
program  segment,  to  time  execution  of  the  self- test  segment.  If 
the  self-test  does  not  execute  within  the  allotted  time,  an 
error  condition  is  generated. 

Two  LED  indicators  are  used  to  provide  redundant  error 
signals.  One  LED  is  normally  ON.  If  the  self-test  software 
detects  an  error,  if  the  interrupt  acknowledge  is  not  generated 
fast  enough,  or  if  a  self- test  program  segment  does  not  execute 
within  the  2-4  ms  window,  then  this  LED  is  turned  OFF  to 
indicate  an  error.  This  provides  a  fail-safe  indicator  since 
the  most  prominent  failure  mode  for  an  LED  is  to  "burn-out” 
which  indicates  an  error.  The  second  LED  provides  a  "heart¬ 
beat"  status  signal.  This  LED  is  toggled  on  and  off  at  a  fixed 
rate  by  the  self-test  program.  This  provides  a  redundant 
indication  of  failure.  This  system  thus  detects  failure  in  both 
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the  primary  system  hardware  and  in  the  self-test  hardware. 

A  small  amount  of  additional  hardware  is  required  to 
provide  "wraparound”  data  paths  for  testing  I/O  ports.  The 
added  hardware  required  constitutes  a  small  percentage  of  the 
total  system  hardware  and  all  added  hardware  is  covered  by  the 
self-test  mechanism  except  the  final  isolation  buffer  that 
prevents  external  devices  from  corrupting  the  self- test  data. 
Fault  Simulation 

One  of  the  difficulties  in  developing  self- tests  for  LSI 
systems  is  trying  to  rate  the  effectiveness  of  the  software. 
The  reason  for  this  is  that,  presently,  the  only  known  way  of 
testing  the  effectiveness  of  self-test  software  is  to  conduct 
"fault  injection  experiments".  One  can  either  run  these 
experiments  with  a  real  hardware  system  or  through  simulation. 
Using  a  hardware  system  is  not  feasible  because  obtaining  LSI 
devices  with  known  internal  defects  is  much  more  difficult  than 
obtaining  good  devices.  Simulation  does  provide  an  answer,  but 
there  are  problems  here  also.  LSI  devices  contain  thousands  of 
gates,  thus  using  traditional  gate  level  simulation  techniques 
can  present  great  difficulties.  The  biggest  problem  is  that 
accurate  gate  level  models  of  LSI  devices  are  usually  known  only 
by  the  manufacturer  and  in  most  cases  they  are  unwilling  to 
divulge  this  information.  Secondly,  even  given  a  gate  level 
model  of  an  LSI  system,  the  simulations  require  too  much  host 
CPU  time,  i.e.  money,  when  validating  self-test  software.  The 
only  solution  to  this  problem  is  to  develop  a  simulation  model 
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at  a  higher  level. 

On  this  contract  a  simulation  language  known  as  GSP 
(General  Simulation  Program)  was  used  to  develop  a  "chip"  level 
model  of  the  8080  system  under  consideration.  In  modeling  at 
the  chip  level,  internal  chip  micro-operations  and  interface 
signal  timing  are  modeled  without  resorting  to  detailed 
description  of  the  internal  gate  structure.  This  allows 
accurate  simulation  of  an  LSI  system  in  an  efficient  manner. 

Once  the  simulation  model  was  developed,  it  was  used  to 
conduct  fault  injection  experiments.  In  these  experiments; 
faults  were  injected  into  the  simulation  model,  and  the 
execution  of  the  self-test  software  was  simulated.  The  fault 
types  simulated  were  (1)  incorrect  device  micro-operations  (2) 
stuck  faults  and  (3)  timing  faults.  Because  of  the  high 
probability  of  interconnect  failures  between  chips  (vs  internal 
defects) ,  43%  of  the  defects  simulated  were  interconnect  faults. 

The  simulation  experiments  allowed  us  to  calculate  a 
"figure  of  merit"  for  the  self-test  routines,  i.e.  approximately 
80%  of  faults  injected  were  detected  by  self-test  mechanisms. 
Hardware  System  Checkout 

In  this  effort  an  8080  laboratory  system  was  constructed 
and  all  self-test  routines  were  executed  on  it.  The  purpose  of 
this  activity  was  to  verify  that  the  test  routines  would  operate 
properly  in  a  real  system  and  that  they  would,  when  finished 
with  their  execution,  leave  the  system  in  a  state  compatible 
with  the  operational  program.  Building  of  the  hardware  system 
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also  allowed  us  to  verify  that  the  limited  amount  of  added  self¬ 


test  hardware  functioned  as  anticipated.  Finally, 
with  the  hardware  system  provided  the  test  program 
simulation  model  developers  with  useful  information 
characteristics. 
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1.  INTRODUCTION 


The  advent  of  LSI  technology  has  presented  computer  system 
designers  with  a  powerful  design  capability.  However,  along 
with  this  increased  capability  has  come  the  attendant  problem  of 
trying  to  verify  that  the  LSI  devices  in  a  system  are  operating 
correctly.  The  large  number  of  logic  gates  on  an  LSI  chip  can 
make  this  testing  process  difficult.  On  the  other  hand,  the  LSI 
chips  in  a  system  tend  to  exhibit  a  degree  of  functional 
independence  from  each  other  and  usually  contain  powerful  logic 
capabilities.  These  features  make  possible  the  implementation 
of  self- test  mechanisms  in  LSI  systems. 

The  purpose  of  the  research  carried  out  under  Air  Force 
Contract  F30602-80-C-0200  was  to  develop  self-test  software  for 
microprocessor  systems  and  verify  the  effectiveness  of  this 
software  through  fault  simulation.  This  document  is  the  final 
report  for  this  research. 

The  research  efforts  carried  out  under  this  contract  can  be 
divided  into  three  major  areas.  The  body  of  the  report  will 
treat  each  area  in  detail  but  we  briefly  summarize  them  here: 

(1)  Development  of  Self  Test  Software.  Under  this  effort, 
a  system  self-test  scheme  was  first  developed  which  identified 
the  major  functions  to  be  performed  by  software  and  a  limited 
amount  of  self-test  hardware  to  achieve  the  testing  goals. 
Next,  within  the  system  scheme,  self-test  routines  were  designed 
and  written  to  test  the  particular  microprocessor  chip  set 
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chosen  for  the  research:  an  8080  microprocessor ,  semiconductor 
random  access  memory  (RAM),  read  only  memory  (ROM)  and  8228, 
8251,  and  8255  support  chips.  Details  of  this  research  area  are 
given  in  section  2  of  the  report. 

(2)  Fault  Simulation.  In  this  part  of  the  research  a 
simulation  model  was  developed  for  the  microprocessor  system. 
The  modeling  was  done  using  the  General  Simulation  Program  (GSP) 
previously  developed  at  VP I .  Once  developed  and  checked  out, 
the  simulation  model  was  used  for  fault  simulation.  Functional 
faults  were  injected  into  the  model  and  the  execution  of  the 
self-test  routines  was  simulated  in  order  to  test  their 
effectiveness  in  detecting  faults.  Details  of  this  research  are 
given  in  section  3  of  the  report. 

(3)  Check  out  of  the  Self  Test  Scheme  on  a  Hardware 
System.  In  this  effort  an  8080  laboratory  system  was 
constructed  and  all  self-test  routines  were  executed  on  it.  The 
purpose  of  this  activity  was  to  verify  that  the  test  routines 
would  operate  properly  in  a  real  system  and  that  they  would, 
when  finished  with  their  execution,  leave  the  system  in  a  state 

compatible  with  the  operational  program.  Building  of  the 
hardware  system  also  allowed  us  to  verify  that  the  limited 
amount  of  added  self- test  hardware  functioned  as  anticipated. 
Finally,  experience  with  the  hardware  system  provided  the  test 
program  writer  and  simulation  model  developers  with  useful 
information  about  the  characteristics  of  the  chips.  Details  of 
this  research  are  given  in  report  section  4. 
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SELF-TEST  METHODOLOGY 

The  motivation  for  this  study  xj  the  development  of  a 
library  of  self-test  software  for  microprocessor-based  control 
systems.  At  one  end  of  the  scale  would  be  a  very  fast  executing 
self-test  program  that  would  provide  as  much  fault  coverage  as 
possible  using  a  minimal  amount  of  extra  hardware  and  a  small 
amount  of  memory.  The  added  cost  for  the  self-test  would  be 
minimal.  At  the  other  end  of  the  scale  would  be  a  comprehensive 
self-test  that  would  provide  the  maximum  possible  fault 

coverage.  It  is  anticipated  that  this  test  would  require 
considerable  execution  time  and  possibly  costly  extra  hardware. 

In  between  these  two  extremes  would  be  a  variety  of  self- test 
mechanisms  that  would  provide  a  wide  range  of  fault  coverages 
with  intermediate  execution  times ,  memory  requirements ,  and 
hardware  costs.  if  such  a  library  existed,  microprocessor 
system  designers  could  select  the  library  program  that  best 
matched  their  particular  requirements. 

This  report  describes  one  program  in  the  library  in  detail. 
The  primary  goal  of  this  project  was  to  develop  a  short  test 
using  minimal  extra  hardware  that  would  achieve  the  highest 
possible  fault  coverage.  It  was  intended  that  successful 
completion  of  this  project  would  establish  credibility  for  the 
library  concept  in  addition  to  being  directly  applicable  in  its 
own  right. 
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2.1  Self-Test  Environment 


Of  all  the  proposed  library  programs,  this  one  would 
minimize  the  impact  on  system  cost,  on  power  requirements,  on 
system  programming  and  on  system  reliability.  The  extra 
hardware  required  can  be  classified  into  three  categories. 
Indicators  of  system  status.  Two  LED's  provide  status 
information.  One  LED  will  be  normally  ON  to  indicate  that  the 
system  is  operational.  This  LED  will  be  turned  off  by  the  self¬ 
test  program  if  it  detects  an  error  condition  or  by  a  hardware 
time-out  if  the  self-test  program  fails  to  respond  within  an 
appropriate  time  period.  The  normally  ON  condition  makes  the 
LED  fail-safe  since  the  most  likely  failure  mode  of  an  LED  is  to 
"burn  out".  However,  it  is  possible  for  the  electronic  driving 
circuit  to  fail  in  such  a  way  as  to  make  the  LED  remain 
permanently  ON.  Therefore  a  second  LED  will  act  as  a 

"heartbeat"  for  the  system.  It  will  be  toggled  off  and  on  at  a 
fixed  visible  rate  by  the  self-test  program.  The  "heartbeat" 
indicator  will  detect  catastrophic  type  failures  where  the 
program  is  executing  in  an  erratic  manner  that  provides 
interrupt  acknowledge  and  false  pass  signals  to  the  fixed  LED. 
This  active  redundant  indicator  will  also  detect  stuck-at 
failures  in  the  driving  circuit  of  the  first  LED.  The  heartbeat 
then  protects  against  failures  in  the  self-test  hardware  and 
catastrophic  failure  of  the  CPU.  For  the  system  to  be  operating 
properly,  the  fixed  LED  must  remain  ON  and  the  "heartbeat”  must 
oscillate  at  a  fixed  visible  rate. 
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Function  Timers 


Two  timers  are  employed.  One  initiates  the  self-test 
program  by  periodically  generating  a  program  interrupt.  The 
other  times  the  response  to  the  interrupt  and  the  execution  time 
of  the  self-test  program.  If  a  system  failure  prevents  the 
microprocessor  from  responding  to  the  interrupt  request  or 
prevents  the  microprocessor  from  executing  the  self-test  program 
in  the  allotted  time  interval,  the  second  timer  will  time  out 
and  indicate  a  system  failure  by  turning  off  the  fixed  LED. 
Wraparound  and  Isolation:  Hardware  for  I/O  Ports 

Since  testing  8255  and  8251  peripheral  I/O  chips  was  an 
important  part  of  the  self-test  objective,  a  means  for  reading 
back  the  data  written  to  the  ports  must  be  provided.  In 
addition,  we  must  isolate  the  peripheral  device  during  testing 
to  prevent  distortion  of  the  testing  data  by  the  external 
devices  and  to  prevent  test  data  from  being  transmitted  to  the 
external  devices  (when  necessary) .  A  device  signal  is  provided 
to  the  external  device  during  testing  to  indicate  CPU  busy 
status.  The  details  of  this  logic  can  be  found  in  Section  4. 

This  hardware  represents  the  minimal  amount  necessary  to 
implement  complete  system  testing.  The  only  burden  placed  on 
external  hardware  is  to  observe  the  busy  signal  and  hold  input 
data  until  the  processor  is  ready  to  accept  it.  A  complete 
description  of  the  hardware  is  provided  in  section  4. 
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2.2  Alternative  Approaches  for  a  Short  Periodic  Test 

A  primary  objective  is  to  make  the  periodic  test 
transparent  to  the  users.  This  has  two  major  raaif ications: 
first,  the  user's  registers  and  stack  must  be  preserved;  second, 
interrupts  must  be  disabled  during  the  test  since  execution  of 
an  interrupt  service  routine  could  lead  to  a  hardware  timeout 
(i.e.,  the  test,  once  started,  must  run  to  completion 
uninterrupted);  third,  the  test  must  execute  in  as  short  a  time 
as  possible  so  that  its  execution  would  not  be  noticed  by  the 
controller  program.  However,  in  general,  a  shorter  test  routine 
results  in  less  fault  coverage.  In  order  to  reduce  execution 
time,  one  tries  to  design  test  algorithms  with  many  operations 
between  verifications;  but  too  few  verifications  may  allow  a 
fault  to  escape  detection.  Thus  a  tradeoff  between  speed  and 
fault  coverage  seems  inevitable. 

Three  different  approaches  were  considered  for  the  short 
periodic  test.  The  first  is  a  simple,  straightforward,  quick 
test.  A  second  approach  uses  a  longer,  more  thorough  (but 
slower)  test  and  partitions  it  into  a  set  of  short  segments  that 
are  executed  one  by  one  at  consecutive  test  times.  A  third 
approach  combines  the  first  two  method Again  a  series  of 
teats  is  employed,  but  now  a  common  'core'  test  is  executed  each 
time.  This  core  attempts  to  verify  enough  operations  so  that 
the  housekeeping  and  dispatch  functions  required  to  decide  which 
segment  is  to  execute  next  can  be  expected  to  function  reliably. 
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The  primacy  advantage  of  the  single  comprehensive  test  is 
its  simplicity.  No  overhead  is  required  to  schedule  test 
segments.  The  major  disadvantage  is  that  fault  coverage  may  not 
be  adequate  for  a  test  that  would  execute  in  the  available  time 
window.  The  single  test  would  certainly  be  preferable  if  the 
coverage  is  adequate.  Our  research  indicates  that  such  a  test 
is  practical  for  the  8080  CPU.  However,  we  found  that  the 
execution  time  required  for  even  a  short  memory  test  was 
excessive  for  this  application.  Since  our  objective  is  to  test 
the  whole  system,  we  were  forced  to  reject  the  single  pass 
approach. 

Experience  with  the  test  routine  showed  that  the  additional 
fault  coverage  gained  by  approach  three  was  not  worth  the 
additional  execution  time.  Therefore,  we  adopted  approach  two 
and  partitioned  the  self-test  into  disjoint  segments. 

2.3  Constraints  Imposed  on  System  Design 

A  major  objective  of  the  self-test  project  was  to  provide 
an  add-on  package  with  minimal  impact  on  the  system  design. 
This  section  describes  the  interaction  required  with  the 
application  system. 

In  the  hardware  area,  the  system  must  react  to  the  self¬ 


test  busy  signal  by  holding  input  data  until  the  self-test  is 
completed.  The  required  display  isolation  buffers  must  be 
provided.  Three  output  port  numbers  must  be  reserved  for 


reporting  the  status  and  controlling  the  timers.  About  IK  bytes 
of  ROM  must  be  reserved  for  the  self-test  program. 

In  the  software  area,  two  vectored  interrupts  must  be 
reserved  for  the  self-test  program.  One  is  used  to  initiate  the 
self-test  execution  and  the  other  as  an  error  exit.  Sufficient 
additional  stack  depth  must  be  provided  to  service  the  self-test 
program.  The  8080  implementation  requires  16  bytes  of  stack 
space  to  execute. 

The  application  program  must  call  the  self-test 
initialization  subroutine  (INIT)  whenever  the  system  executes  a 
cold  start  or  system  reset.  See  Section  2.6.1  for  details.  The 
programmer  must  also  reserve  8  or  9  bytes  of  system  RAM  for  the 
use  of  the  self-test  program. 

In  addition,  the  application  program  must  operate  with 
interrupts  enabled  most  of  the  time.  An  extensive  period  with 
interrupts  disabled  would  cause  a  hardware  time-out.  If  the 
user  has  ROM  to  be  included  in  the  self-test,  he  must  provide 
one  checksum  byte  somewhere  in  every  128  byte  block.  See 
Section  2.6.4  for  details. 

2.4  Partitioning  the  System 

Since  we  are  doing  functional  testing,  the  most  logical 
method  to  use  in  partitioning  is  based  on  function.  In  general, 
the  CPU  test,  if  possible,  should  be  done  in  one  segment. 
Memory  will  generally  require  many  segments.  As  many  I/O 
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devices  as  possible  should  be  included  in  the  remaining 
segments.  Bach  segment  should  be  approximately  the  same  length 
in  execution  time. 

For  the  8080  system,  we  were  able  to  test  the  8080  CPU  and 
the  8255  I/O  port  in  the  first  segment.  The  ROM  test  was 
partitioned  into  128  byte  segments  and  the  RAM  test  into  32  byte 
segments.  The  8251  test  required  two  segments.  Execution  time 
of  each  segment  was  approximately  4  milliseconds.  The  8251  test 
execution  time  is  practically  clock  independent  since  it  depends 
mostly  on  the  baud  rate. 

2.5  General  Statements  about  the  Short  Test  Algorithms 

The  self- test  algorithms  are  designed  to  provide  systemwide 
functional  GO/NO-GO  tests;  they  do  not  provide  diagnostic 
information  about  what  fault  occurred.  As  such,  they  employ  the 
'start  big'  approach;  i.e.,  they  jump  right  into  testing  various 
functional  elements  rather  than  slowly  building  up  from  a  small 
core.  The  tests  are  systemwide  in  that  failures  cannot  be 
isolated  to  a  single  device;  for  example,  a  ROM  or  RAM  fault 
could  well  cause  the  CPU  test  to  fail.  The  algorithms  were 
developed  to  cover  single  functional  faults,  although  most 
multiple  faults  will  also  be  detected. 

Since  there  is  virtually  no  failure  mode  data  for 
microprocessors  and  their  support  chips,  we  don't  know  what 
faults  are  most  likely  to  occur  and  cannot  concentrate  on 
testing  for  specific  faults.  Therefore  the  basic  goal  of  the 
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self- test  is  to  exercise  all  functional  elements  and  data  paths 
of  the  microprocessor  system  (excluding  user  peripherals ,  but 
including  their  I/O  ports) .  Of  course,  exercising  a  faulty 
element  or  function  does  not  guarantee  detecting  the  fault; 
therefore  we  have  made  use  of  fault  simulation  results  to 
determine  how  effective  the  self-tests  are.  (See  Section  3.) 
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2.5.1  The  CPU 


The  most  complex  component  to  test  is  the  CPU  itself;  in 
general  it  consists  of  an  ALU  (arithmetic  6  logic  unit) ,  a 
(user)  register  array,  other  assorted  registers  and  latches 
(accumulator (s) ,  instruction  register,  etc.),  some  flags, 
instruction  decoding  logic  (probably  an  internal  ROM) ,  timing 
and  control  circuitry,  and  the  data  paths  connecting  these 
elements. 

The  self-test  exercises  all  functions  of  the  ALU,  thus 
testing  the  ALU  control  logic.  The  full  adders  that  perform 
addition  and  subtraction  are  exercised  by  applying  all  input 
combinations  to  each  adder  (i.e.  each  bit  position);  since  a 
full  adder  is  a  3-input  device  (2  source  operands  and  a  carry 
in) ,  8  input  combinations  per  adder  are  required.  This  tests 
for  all  detectable  stuck-at  faults  and  some  shorts/opens  in  the 
adders.  Similarly,  the  logic  that  performs  AMD,  OR,  and  XOR  is 
exercised  by  applying  all  four  possible  input  combinations  to 
each  bit  position.  (That  is,  each  bit  position  of  each  logic 
function  is  tested  with  inputs  of  00,  01,  10,  and  11.)  Other 
functions  (such  as  rotates)  are  tested  in  a  similar  manner,  by 
applying  all  input  combinations  to  each  bit  position  for 
thorough  coverage.  A  decimal  (BCD)  adjust  function,  if  present, 
should  be  tested  for  no  adjustment,  adjustment  due  to  flags,  and 
adjustment  due  to  a  digit  greater  than  nine. 
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The  register  array  contains  RAM  (register  memory) ,  register 
select  logic  and  multiplexers,  and  possibly  increment/decrement, 
rotate,  clear,  and/or  complement  logic.  The  RAM  must  be  tested 
for  stuck-ats  and  shorts  between  adjacent  bits;  just  which  bits 
are  adjacent  depends  on  the  RAM  layout  (which,  in  general,  is 
unknown) .  Therefore  the  test  requires  loading  (and  verifying) 
at  least  three  patterns  into  each  register;  the  patterns  apply 
both  a  0  and  a  1  to  each  bit  position  (stuck-at  test) ,  and  the 
same  and  complement  values  to  each  pair  of  adjacent  bits  (test 
for  shorts) .  These  same  patterns  will  also  be  used  in  testing 
the  processor's  other  registers  and  latches  and  the  data  paths. 
This  will  be  done  by  executing  instructions  that  move  the 
register  data  through  the  desired  data  paths  to  the  other 
registers.  When  the  internal  layout  of  register  memory  and  data 
paths  is  unknown  (as  usual) ,  the  most  logical  assumption  is  that 
logically  adjacent  bits  are  physically  adjacent  (this  is 
certainly  true  for  at  least  some  of  the  registers,  latches, 
and/or  data  paths) .  Under  this  assumption,  some  suitable 
patterns  are  (in  hexadecimal):  00,  55,  &  AA;  33,  66,  &  CC;  D9, 
6C,  6  36.  The  patterns  are  distributed  in  the  registers  so  that 
register  select  faults  may  also  be  detected,  assuming  either 
logical  ORing  or  logical  ANDing  (as  appropriate  for  the 
technology  employed)  of  register  contents  for  a  multiple  select 
fault  on  reading.  Thus  the  tests  employ  different  patterns  in 
the  different  user  registers  so  that  R1  OR  R2  (or  R1  AND  R2,  as 


appropriate)  equals  neither  R1  nor  R2.  This  allows  both 
erroneous  select  and  multiple  select  faults  to  be  detected.  A 
fault  resulting  in  no  register  being  selected  will  be  easily 
detected  when  using  these  patterns.  The  contents  of  all  user 
registers  are  verified  near  the  end  of  the  test,  so  that  an 
erroneous  write  or  multiple  write  fault  can  be  detected. 

Increment/decrement  logic  would  probably  be  centralized  in 
one  unit  within  the  register  array  (as  in  the  8080);  however, 
the  exact  gate  implementation  is  most  likely  unknown.  For  this 
reason,  the  self-test  applies  only  a  few  basic  test  vectors, 
such  as  incrementing  -1  (all  ones)  and  decrementing  zero,  which 
tests  carry/borrow  propagation  through  every  bit.  Carry/borrows 
through  no  bits  (incrementing  an  even  number  and  decrementing  an 
odd  number)  and  through  an  intermediate  number  of  bits  are  also 
tested.  It  should  be  noted  that  this  logic  may  also  be  used  to 
increment  the  program  counter  (PC)  and/or  stack  pointer  (SP)  (as 
is  the  case  for  the  8080) ,  which  provides  some  additional 
increment  testing.  Other  possible  register  functions,  such  as 
clear  or  complement,  are  most  likely  built  into  each  register  if 
they  are  present  at  all.  These  are  easily  tested,  but  testing 
and  verifying  each  function  of  each  register  will  be  time 
consuming,  so  that  a  tradeoff  may  be  necessary. 

Any  microprocessor  will  contain,  in  addition  to  the 
register  array,  some  internal  registers  and  latches  and  possibly 
special  accumulator  registers.  These  registers  may  be  tested 
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for  stuck-ats  and  shorts  between  adjacent  bits  by  using  the  sane 
patterns  discussed  above,  assuming  they  can  be  loaded  by 
software  (either  directly  or  indirectly) .  The  instruction 
register  (IR)  is  of  interest  in  that  it  is  loaded,  not  with 
data,  but  with  instruction  opcodes;  this  means  that  a  fault  will 
result  in  the  execution  of  some  erroneous  instructions,  possibly 
causing  loss  of  program  control.  This  cannot  be  avoided; 
however,  as  long  as  the  GO  signal  is  not  generated,  a  hardware 
timeout  will  provide  the  needed  NO-GO  result,  so  that  the  fault 
will  be  detected.  Accumulator  registers  are  also  of  interest  in 
that  they  inevitably  have  special  functions,  such  as  complement 
and/or  increment.  The  self-test  must  exercise  each  function  of 
each  accumulator  with  sufficient  patterns  to  ensure  the 
detection  of  any  (detectable)  stuck  bits.  Two  complementary 
patterns  will  suffice  to  test  complement  logic;  but  note  that 
two  successive  complements  (with  no  verification  in  between) 
results  in  a  poor  test,  since  the  correct  final  result  will  be 
obtained  if  each  complement  does  nothing  at  all.  The  program 
counter  (PC)  and  address  latches/buffers  are  of  special  interest 
as  well,  because,  for  meaningful  results,  only  valid  memory  and 
I/O  addresses  can  be  applied.  However,  these  registers/latches 
are  used  for  all  memory  reads  and  writes,  including  instruction 
fetches,  and  sometimes  for  I/O,  so  that  enough  patterns  will  be 
applied  during  the  course  of  the  test  to  detect  most  stuck- 
ats/shorts.  Increment  and  decrement  functions  are  tested  as 
described  above. 


14 


The  condition  flags  make  up  another  CPU  element  to  test. 
The  self-test  simply  applies  and  verifies  (by  conditional  jump, 
add  with  carry,  ...)  both  one  and  zero  (true  and  false)  for 
each  flag.  Shorts  between  the  flag  flip  flops  are  conceivable, 
but  cannot  be  efficiently  tested  for  without  knowing  the 
internal  layout.  The  logic  driving  the  flags  is  exercised 
throughout  the  test  by  numerous  arithmetic  and  logical 
instructions;  but  obviously  the  test  can  only  verify  the  flags 
at  strategic  points  (optimally  where  another  function  is  also 
verified)  to  minimize  execution  time. 

The  instruction  decoding  and  machine  cycle  encoding  unit  of 
the  CPU  is  the  most  difficult  component  to  test.  To  simplify 
LSI  implementation,  the  decoder  most  likely  employs  ROM,  the 
exact  nature  of  which  is  unknown.  Thus  a  fault  in  the  ROM  could 
conceivably  be  manifested  for  only  a  single  instruction.  Also, 
note  that  faults  in  instruction  decoding,  like  faults  in  the 
instruction  register,  may  cause  erratic  behavior  or  even  loss  of 
program  control  (hopefully  resulting  in  a  hardware  timeout) . 
Since  the  self-test  cannot  execute  and  verify  every  instruction 
in  the  short  time  available,  it  simply  covers  as  many  classes  of 
instructions  and  as  many  micro-operations  as  possible.  For 
example,  only  a  few  register  to  register  moves  are  tested, 
instead  of  trying  to  move  each  register  to  each  other  register. 
All  types  of  addressing  and  all  types  of  parameters  (registers, 
immediate  data  of  all  lengths,  immediate  addresses)  are  employed 
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through  the  course  o£  the  test.  However  some  instructions  (such 
as  halt)  cannot  be  self-tested  without  special  hardware.  The 
most  commonly  used  instructions  (such  as  adds,  compares, 
branches,  etc.)  are  tested  most  thoroughly.  Conditional 
transfers  (jumps,  calls,  and  returns) ,  for  example,  are  tested 
for  both  transfer  and  no- transfer;  note  that  this  overlaps  with 
flag  testing  and  almost  everything  else,  since  the  conditional 
transfers  are  used  f^;  verifications  of  other  functions.  This 
overlap  is  typical  of  the  'start  big1  approach,  several 
functions  being  tested  together. 

The  self-test  is  designed  to  exercise  all  possible  micro¬ 
operations,  thus  testing  some  decoding  and  most  of  the  machine 
cycle  encoding.  The  micro-operations  are  determined  from  the 
processor's  User's  Manual  based  on  the  data  paths,  CPU  elements, 
and  functions  employed  by  each  instruction.  All  registers  of 
the  register  array  are  considered  equivalent  since  they  use 
identical  data  paths  external  to  the  array  (only  register 
selection  differs,  and  this  was  considered  previously) .  The 
other  registers  (IR,  accumulator,  ...)  are  treated 
independently  since  their  data  paths  differ.  Conditional  type 
instructions,  which  employ  different  micro-operations  under 
different  conditions,  are  considered  to  cover  only  those  micro¬ 
operations  common  to  both  conditions.  This  prevents  the 
illusion  of  covering  micro-ops  that  may  in  fact  not  be  performed 
during  instruction  execution.  Software  has  been  developed  to 
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determine  the  micro-operation  coverage  of  a  given  test 
algorithm,  and  to  find  a  minimal  set  of  instructions  that  cover 
any  set  of  micro-operations.  Fault  simulation  will  be  required 
to  determine  actual  fault  coverage,  since  exercising  a  faulty 
micro-op  does  not  guarantee  detecting  the  fault. 

Since  the  micro-operations  are  derived  based  in  part  on  the 
data  paths  they  use,  exercising  all  micro-operations  also  serves 
to  exercise  all  data  paths.  Most  of  the  data  paths  are 
exercised  with  the  register  test  patterns  previously  described, 
thus  testing  for  stuck-ats  and  shorts  between  adjacent  bits.  As 
mentioned  earlier,  this  is  performed  by  executing  instructions 
that  move  data  from  the  registers  over  the  desired  data  paths 
(thus  providing  more  overlap).  Some  data  paths,  however,  cannot 
be  directly  exercised  with  these  patterns.  For  example, 
consider  the  data  paths  leading  to  the  instruction  register  and 
those  leading  to  an  address  buffer.  For  meaningful  results, 
only  valid  opcodes  and  valid  addresses,  respectively,  can  be 
applied  to  these  data  paths.  However,  during  the  course  of  the 
test,  enough  opcodes  will  pass  into  the  instruction  register  to 
effectively  test  for  any  stuck-ats/shorts  in  IR  or  its  data 
paths.  Also,  the  RAM,  ROM,  and  I/O  tests  will  access  all  valid 
addresses  so  that  most  stuck-ats/shorts  in  the  address  circuitry 
can  be  detected.  Thus  although  complete  stuck-at/short  coverage 
is  not  in  general  possible  for  all  data  paths,  the  self-test  can 
still  verify  that  valid  data  will  not  be  distorted.  What 
happens  to  invalid  addresses  is  not  important  anyway. 
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The  final  part  of  the  CPU  is  its  timing  and  control 
circuitry;  this  cannot  be  directly  self-tested.  However,  by 
exercising  all  micro-operations,  the  self-test  will  also 
exercise  much  of  this  control  circuitry.  Further,  the  hardware 
timeout  feature  guards  against  some  possible  major  control 
faults  that  are  totally  transparent  to  the  software,  such  as 
generation  of  numerous  unneeded  hold  or  wait  states.  Also, 
interrupt  control  is  verified  since  the  test  is  initiated  by 
interrupt.  Still,  some  control  signals  cannot  be  self-tested 
without  considerable  extra  hardware  because  of  their  nature 
(e.g.,  the  HOLD/HOLD  Acknowledge  circuitry  of  the  8080  is  used 
for  DMA  by  external  devices  and  thus  is  completely  transparent 
to  software) .  This  is  a  limitation  that  cannot  be  avoided 
without  the  addition  of  considerable  extra  hardware. 

2.5.2  ROM 

ROMs  are  the  easiest  system  component  to  test.  A  checksum 
is  stored  in  the  ROM  itself  to  produce  a  known  result  when  the 
contents  of  all  (or  a  certain  piece  of)  ROM  are  summed.  Several 
different  methods  of  forming  this  sum  have  been  considered.  The 
first  uses  a  modulo  2  sum,  in  effect  an  exclusive  OR;  each 
column  (bit  position)  is  independent  of  the  others  (there  are  no 
carries).  However,  two  faults  in  the  same  column  would  go 
undetected;  hence  this  method  was  rejected.  The  second  method 
uses  a  modulo  256  sum,  namely  the  ADD  instruction;  carries  out 
of  the  most  significant  bit  (MSB,  bit  7)  are  lost.  But  two 
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faults  in  the  MSB  column  would  again  go  undetected,  so  this 
method  was  enhanced  to  form  the  third  approach:  the  carry  out 
of  the  MSB  (from  the  ADD)  is  added  back  to  the  least  significant 
bit  (LSB,  bit  0)  of  the  sum;  thus  nothing  is  lost.  Now  to 
escape  detection,  the  two  faults  must  not  only  be  in  the  same 
column,  but  they  must  also  be  complementary.  That  is,  one  must 
be  a  0  turned  1,  and  the  other  a  1  turned  0.  But  due  to  the 
physical  nature  of  a  ROM,  PROM,  or  EPROM,  this  is  extremely 
unlikely;  faults  will  normally  occur  in  only  one  direction. 
Thus  0's  may  turn  to  l's  or  l's  to  0's,  but  not  both.  Under 
this  assumption,  the  third  test  method  will  prove  quite 
effective. 

Another  consideration  for  the  ROM  test  is  how  many 
checksums  to  use.  The  test  algorithm  is  passed  the  start 
address  of  the  ROM  to  test  to  make  it  address  independent,  but 
this  also  allows  the  ROM  to  be  tested  in  pieces  of  any  size 
desired,  so  long  as  each  piece  contains  a  checksum  byte  (to  give 
the  required  sum) ;  the  checksum  may  be  anywhere  in  the  block  of 
ROM  under  test.  The  ROM  test  could  thus  be  broken  up  into  a 
series  of  tests,  so  that  periodic  tests  can  execute  in  the  short 
time  available. 

The  final  consideration  is  what  number  to  use  as  the  final 
known  result  of  the  sum.  A  sum  to  -1  (PP  hex)  was  considered 
until  we  noticed  that  a  'dead*  ROM  (permanently  deselected) 
would  pass  the  test.  (Since  the  bus  would  float  when  the  ROM 
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should  be  active,  FF  hex  would  be  read  as  the  contents  of  each 
byte,  resulting  in  the  net  sum  of  FF  hex.)  A  sum  to  zero  was 
similarly  rejected  in  favor  of  a  sum  to  AA  hex,  since  the  latter 
is  a  'checkerboard*  pattern  (10101010  binary). 

The  test  algorithm  thus  tests  the  ability  of  the  ROM  to 
access  each  location  which  verifies  the  address  decoders,  select 
logic,  output  drivers,  and  the  ROM  contents. 

2.5.3  RAM 

Many  techniques  for  RAM  testing  have  been  developed  over 
the  past  decade,  each  with  its  own  advantages  and  disadvantages. 
But  all  thorough  RAM  tests  share  a  common  drawback:  they  take 
forever.  Faster,  specialized  tests  could  be  developed  were  the 
internal  cell  layout  of  the  RAM  known,  since  then  a  cell's  true 
neighbors  would  be  known.  This  would  permit  minimal  tests  of 
the  decoders  (access  each  row  and  column  of  the  RAM  only  once) 
and  allow  true  nearest  neighbor  (disturb)  tests.  But  cell 
layouts  vary  from  manufacturer  to  manufacturer  and  are  almost 
never  made  available  to  users. 

The  Moving  Inversions  (MOVI)  test  technique  is  one  example 
of  a  thorough  test,  and  it  is  much  faster  than  Walking  or 
Galloping  tests  (1,2).  A  memory  location  is  first  read  to 
verify  it  contains  the  previous  pattern;  then  the  current 
pattern  is  written  and  immediately  read  back  for  verification 
(to  try  and  detect  write  recovery  faults) .  This  continues  until 
the  memory  is  filled  with  the  current  pattern.  The  patterns 


20 


employed  are  (in  hexadecimal):  00,  01,  03,  07,  ...,  7F,  FF,  FE, 
FC,  F8,  ...,  80,  and  back  to  00;  thus  one  bit  is  inverted  each 
time.  MOVI  sequences  through  the  RAM  first  moving  forward  (up) 
and  then  backward  (down) .  In  addition,  MOVI  steps  through 
memory  using  each  address  bit  as  the  LSB;  that  is,  MOVI  first 
moves  from  location  N  to  N+l  (N-l  on  down  cycle) ,  then  from  N  to 
N+2  (N-2)  on  the  next  pass,  then  N  to  N+4  (N-4) ,  etc.  Thus  all 
fundamental  address  transitions  are  tested  (i.e.  a  change  by  a 
power  of  two,  both  forwards  and  backwards);  this  provides  some 
testing  for  cell,  row,  and  column  disturb  faults  (despite  the 
unknown  layout) .  In  order  to  test  all  of  these  basic  address 
transitions,  the  test  program  tests  all  of  (contiguous)  RAM  at 
once  (testing  smaller  pieces  would  not  test  all  basic 
transitions) .  Refer  to  reference  [1]  for  complete  details  on 
MOVI.  Note  that  MOVI  does  not  test  refresh  for  dynamic  RAMs. 

MOVI  is  a  fairly  good  test  for  address  decoder  switching 
speed,  cell,  row,  and  column  disturb  faults,  data  sensitivity, 
and  write  recovery  faults  [2].  It  is  a  very  good  test  of 
address  uniqueness  ,  and  a  good  general  test  of  both  functional 
and  dynamic  behavior  [1] . 

The  MOVI  test  requires  12  x  B  x  n  x  N  memory  cycles,  where 
B  -  number  of  bits  per  word,  n  ■  number  of  address  bits,  and  N  « 
2**n  -  number  of  RAM  locations.  Naturally,  a  self-test  program 
is  much  slower  due  to  all  the  overhead  it  must  perform.  The 
MOVI  test  implemented  for  the  8080  requires  about  20  seconds  per 
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IK  of  RAM.  Also,  this  test  is,  of  necessity,  destructive;  that 
is,  original  RAM  contents  are  lost.  Thus  MOVI  is  not  at  all 
suitable  for  a  short,  periodic  test. 

Therefore,  two  nondestructive  tests  were  developed  for  the 
short  periodic  test,  but  they  are,  of  necessity,  not  as 
thorough.  Both  algorithms  make  use  of  'random*  patterns, 
generated  using  a  feedback  shift  register  technique.  This 
employs  an  irreducible  polynomial  of  degree  8  to  generate  a 
sequence  of  255  test  patterns.  The  programs  generate  the  next 
pattern  by  shifting  the  current  pattern  left  and  exclusive-ORing 
bits  2,  3,  and  4  with  the  carry  out  from  the  MSB  (bit  7).  This 
carry  out  is  also  shifted  into  the  LSB  of  the  new  pattern. 
Starting  with  55  hex,  the  sequence  is:  55,  AA,  49,  92,  39,  72, 
E4,  etc.  Thus  the  desired  'randomness'  is  achieved.  All  8-bit 
patterns  except  00  will  be  generated  before  the  sequence 
repeats.  Note  that  test  algorithms  using  this  technique  require 
one  byte  of  RAM  in  which  to  store  the  current  pattern.  Since 
these  random  patterns  change  from  test  run  to  test  run,  numerous 
different  patterns  will  be  applied  (over  time) ,  which  provides 
some  likelihood  of  detecting  pattern  sensitive  faults.  The 
algorithms  are  passed  the  start  location  of  the  RAM  to  test,  so 
that  RAM  may  be  tested  in  segments. 

The  first  algorithm  tests  RAM  one  location  at  a  time,  thus 
not  testing  address  decoding  (uniqueness)  at  all.  It  works  as 
follows: 
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(1)  Read  &  save  a  RAN  byte 

(2)  Write/verify  complement  of  original  contents 

(3)  Write/verify  'random'  pattern 

(4)  Write/verify  complement  of  'random'  pattern 

(5)  Restore/verify  original  contents 

The  second  algorithm  tests  groups  of  two  successive  RAM 
locations,  thus  providing  a  minimal  test  for  address  uniqueness. 
It  works  as  follows,  where  H  and  M+l  are  the  two  locations  under 
test: 

(1)  Read  &  save  both  M  &  M-tl 

(2)  Write  'random'  pattern  to  M+l;  verify  both  M  &  M+i 

(3)  Write  complement  of  'random'  pattern  to  M; 

verify  both  M  &  M+l 

(4)  Restore  &  verify  both  M  &  M+l 

Location  M+l  then  becomes  the  next  M,  and  the  test 
continues. 

Both  algorithms  immediately  follow  each  memory  write  with  a 
read  from  the  same  location  in  an  effort  to  detect  write 
recovery  faults.  However,  the  algorithms  test  primarily  for 
data  errors  in  a  RAM  cell  and  the  ability  to  read  and  write, 
with  at  best  minimal  testing  of  other  RAM  faults  (such  as  cell, 
row,  and  column  disturb  faults,  address  uniqueness,  and  address 
decoder  switching  speed) .  Note  that  although  the  sequence  of 
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'random'  patterns  does  not  include  zero,  a  zero  pattern  will 
eventually  be  written  since  the  complement  of  the  'random' 
pattern  is  also  used. 

2.5.4  I/O  Pores 

As  mentioned  in  Section  2.1,  self-testing  I/O  ports 
requires  external  wraparound  hardware.  Consider  a  serial  I/O 
port  chip  (such  as  an  8251) ;  three  tri-state  buffers  can  provide 
wraparound.  Two  are  normally  enabled  to  allow  passage  of  user 
I/O  data;  the  third,  normally  disabled,  connects  the  serial 
output  to  the  serial  input.  Then  in  test  mode  the  first  two 
buffers  are  disabled  (tri-stated) ,  Isolating  the  user's  external 
serial  device,  and  the  third  buffer  is  enabled  for  wraparound. 
Thus  serial  data  output  will  be  received  by  the  same  chip's 
serial  input,  simultaneously  exercising  both  transmit  and 
receive  logic  if  the  serial  chip  is  full  duplex.  Parallel  I/O 
chips  are  tested  similarly,  using  a  single  I/O  chip  if  it  has 
multiple  I/O  ports  (as  does  the  8255)  or  using  one  output  chip 
and  one  input  chip  if  not  (thus  testing  both  at  once) . 

Serial  I/O  chips  (OARTs/USARTs)  and  some  parallel  I/O  chips 
handshake  with  the  CPU  by  means  of  status  bits.  In  general,  the 
processor  must  wait  for  proper  status  before  performing  input  or 
output.  This  means  that  a  fault  in  the  I/O  chip  could  leave  the 
CPU  in  an  infinite  wait;  this,  however,  will  result  in  a 
hardware  timeout  so  that  the  NO-GO  test  result  will  still  be 
generated. 
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Some  of  the  more  recent  LSI  I/O  chips  (like  the  8251  t 
8255)  are  software  programmable  and  can  function  in  more  than 
one  operational  mode.  Unfortunately,  the  chip's  current  mode 
cannot,  in  general,  be  read  back  from  the  chip.  This  presents  a 
severe  problem  to  the  self- test  program.  If  it  is  to  be 
nondestructive  (as  the  periodic  test  must  be),  the  chip's 
current  mode  must  be  restored  before  returning  control  to  the 
application  program.  But,  since  the  current  mode  cannot  be  read 
from  hardware,  the  applications  program  would  have  to  be 
constrained  to  store  current  mode  data  in  RAN  accessible  to  the 
self-test  routine.  Since  most  applications  never  change  the 
mode  of  the  I/O  port,  the  best  solution  seems  to  be  testing  the 
chips  thoroughly  (in  more  than  one  mode)  only  after  system  RESET 
(or  upon  user  request) ,  and  performing  configuration  dependent 
nondestructive  tests  periodically. 

The  serial  port  test  algorithm  consists  of  three  parts:  a 
transmit/receive  test;  a  break  send/receive  test;  and  an  overrun 
error  detection  test.  Tests  for  framing  or  parity  errors  would 
require  external  hardware,  and  are  therefore  not  performed.  The 
transmit/receive  test  simply  outputs  test  patterns  and  verifies 
that  the  same  pattern  is  received  (via  the  wraparound)  with  no 
errors.  (Note  that  this  also  serves  to  test  the  wraparound.) 
The  patterns  used  are  (hexadecimal)  00,  55,  and  AA  —  the  same 
patterns  that  were  used  in  the  CPU  register  test.  This  tests 
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for  stuck-ats  or  shorts  between  adjacent  bits  in  the  parallel 
data  paths  leading  to  the  I/O  port  and  in  the  chip's  data 
registers,  as  well  as  testing  the  serial  send/receive  circuitry 
and  portions  of  the  status  logic.  The  break  test  works  in  a 
similar  fashion:  a  send  break  command  is  issued  and  then  the 
CPU  waits  for  the  break  detect  (received)  status  bit  to  come 
active.  In  the  overrun  error  test,  the  CPU  outputs  one 
character  and  waits  until  the  UART  has  received  it;  then, 
without  reading  this  character,  the  CPU  outputs  a  second 
character  and  waits  for  it  to  be  transmitted  and  received.  Then 
the  processor  verifies  that  the  overrun  error  status  bit  is  set 
and  that  the  second  character  can  be  read  correctly  (the  first 
is  lost) .  Thus  most  of  the  status  and  I/O  circuitry  has  been 
tested.  A  more  thorough  destructive  test  would  repeat  the  test 
for  different  baud  rates,  character  lengths,  and/or  other 
programmable  features. 

A  parallel  I/O  port  test  is  much  more  chip  dependent; 
simple  I/O  can  be  tested  by  applying  the  same  patterns  used  in 
CPU  register  testing  (00,  55,  &  AA  hex  will  do).  This  tests  the 
data  paths,  data  registers  (if  any),  output  drivers,  wraparound 
data  paths,  and  input  circuitry  for  stuck-at's  or  shorts  between 
adjacent  bits.  (Mote  that  strobe  driven  input  may  require  some 
special  hardware  to  generate  the  strobe  signal.)  Special 
functions  (like  the  8255' s  Port  C  single  bit  set/reset  function) 
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ace  then  tested  £or  correct  functional  operation,  provided  they 
do  not  alter  the  chip's  current  operating  mode  (so  that  the  test 
remains  nondestructive) . 
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2.6  Implementation  of  the  Algorithm  for  the  8080  System 

The  preceding  section  considered  test  algorithms  for 
microprocessor  systems  in  general.  That  methodology  has  been 
applied  to  a  system  consisting  of  an  8080  CPU,  RAM,  ROM,  8251 
serial  I/O  port,  and  8255  parallel  I/O  port.  This  section  of 
the  report  will  discuss  the  self-tests  developed  for  this  8080 
system.  It  should  be  noted  that  the  8228  (system  controller) 
and  8224  (clock  generator)  are  considered  part  of  the  CPU 
element,  along  with  the  8080  itself.  This  is  reasonable  since 
these  chips  are  usually  located  on  the  same  printed  circuit 
board  as  the  CPU. 

2.6.1  Preliminary  Considerations 

This  program  is  written  in  such  a  way  as  to  be  applicable 
to  as  wide  a  variety  of  user  environments  as  possible.  Also, 
the  user  responsibilities  are  reduced  to  a  minimum.  However,  it 
is  never  possible  to  be  completely  transparent.  The  program 
must  know  certain  parameters  about  the  actual  system.  The  user 
must  provide  these  constants  as  shown  in  the  configuration 
dependent  assembly  language  equate  statements  on  page  A.l. 

The  first  item  that  must  be  specified  is  the  starting 
address  of  a  1.25K  (1280)  b/te  segment  of  ROM  to  be  used  for  the 
self-test  program.  This  is  specified  by  defining  the  system 
parameter  START  as  shown  on  page  A.l. 
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Other  items  to  be  specified  include  the  address  ranges  of 
RAM  and  ROM,  the  memory  mapped  addresses  of  the  8255  and  8251 
data  ports  and  the  three  memory  mapped  I/O  addresses  necessary 
to  configure  the  wraparound  logic  and  the  self-test  timers.  (See 
Appendix  A,  page  A.l.) 

Also,  8  contiguous  bytes  of  system  RAM  must  be  reserved  .'or 
use  by  the  self-test  program.  The  user  must  specify  the  address 
of  the  first  of  these  eight  bytes  by  defining  the  value  of  TSTAD 
(page  A.l) . 

The  ROM  and  RAM  test  segment  sizes  may  be  changed  by 
altering  the  ROMSS  and  RAMSS  parameters.  This  segment  size  must 
always  divide  the  ROM  or  RAM  into  an  integral  number  of 
segments,  and  hence  should  usually  be  a  power  of  2.  Note  that 
changing  the  ROM  segment  size  (ROMSS)  will  change  the  number  of 
checksums  required  for  the  self-test  program  listed  in  Appendix 
A.  Increasing  ROMSS  results  in  fewer  checksums,  while 
decreasing  ROMSS  increases  the  number  of  checksums  and  may 
require  adding  JMP's  around  the  checksum  byte  (if  the  checksum 
must  be  placed  within  a  block  of  program  code) .  Naturally, 
increasing  a  segment  size  increases  the  time  per  test  pass, 
while  decreasing  either  segment  size  makes  for  faster  test 
passes. 

In  addition,  any  user  ROM  to  be  included  in  the  self-test 
must  include  a  checksum  byte  somewhere  within  each  128  byte 
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block.  The  checksum  is  chosen  so  that  the  modulo  256  sum  (with 
end  around  carry)  of  all  128  bytes  in  the  block  is  AA(Hex) .  A 
jump  around  this  checksum  may  also  be  needed,  so  that  4  bytes 
out  of  each  128  bytes  of  user  ROM  must  be  dedicated  to  the  self¬ 
test  function.  Only  one  byte  is  required  if  there  is  an 
unconditional  branch  in  the  block,  since  the  checksum  may  then 
be  placed  immediately  after  this  transfer.  The  128  byte  block 
size  was  chosen  so  that  each  ROM  test  segment  will  execute  in 
approximately  the  same  amount  of  time  as  the  CPU/8255  test 
segment.  The  block  size  is  small  because  the  CPU  self-test  was 
made  as  short  as  possible. 

The  initialization  routine  is  shown  on  page  A. 23.  This 
routine  (INIT)  must  be  called  by  the  applications  program  when 
processing  a  reset.  This  routine  initializes  all  of  the  self¬ 
test  variables  in  the  self-test  portion  of  RAM  and  intializes 
the  programmable  timers. 

The  entry  point  (START)  must  be  reached  from  one  of  the  8 
vectored  interrupt  locations  selected  by  the  system  designer. 
All  registers  and  flags  from  the  main  program  are  saved  on  the 
main  program  stack.  The  entry  routine  also  initializes  the 
timeout  counter  and  reads  the  address  of  the  next  scheduled  test 
segment  from  TSTAD.  At  the  end  of  each  routine,  TSTAD  is  loaded 
with  the  address  of  the  next  segment  to  follow.  Successive 
interrupts  will  then  execute  successive  test  segments.  Variable 


30 


PAGE  31 


values  that  need  to  be  retained  are  stored  in  the  8  reserved  RAN 
locations. 

2.6.2  Reporting  Status 

If  the  self-test  discovers  an  error,  the  ERR  routine  (shown 
on  page  A. 2)  is  executed.  In  our  implementation,  the  LED  that 
normally  remains  on  is  turned  OFF  to  indicate  an  error 
condition.  The  processor  is  then  halted.  This  routine  was 
placed  at  the  beginning  of  the  self-test  program  to  increase  the 
probability  of  the  HLT  being  executed  when  the  CPU  is  bad. 
Three  successive  HLT  statements  take  care  of  possible  byte  skew 
due  to  software  failure. 

If  the  current  test  segment  executes  properly,  the  GOEXIT 
routine  is  executed.  This  routine  initializes  the  main 
interrupt  counter  to  the  desired  interval  and  restarts  the 
timeout  counter  to  insure  the  next  interrupt  is  processed.  If 
the  self-test  program  did  not  execute  properly  in  the  allotted 
time,  then  the  timeout  counter  would  turn  off  the  error  LED. 
This  would  fail  only  if  the  GOEXIT  routine  were  accidentally 
executed  properly  by  a  faulty  processor.  To  minimize  this 
probability  three  HLT  instructions  precede  this  routine.  Also, 
the  software  error  routine  immediately  precedes  this  routine. 
We  therefore  minimize  the  probability  of  a  faulty  GO  signal  as 
much  as  possible. 
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2.6.3  The  CPU  Test 

The  8080  CPU  test  is  shown  in  A. 4— A. 11.  The  8080  CPU 
self- test  exercises  all  ALU  functions,  which  overlaps  with 
exercising  all  possible  micro-operations.  These  ALU  functions 
are:  ADD  and  SUBtract  both  with  and  without  carry/borrow  (and 
for  carry/borrow  of  both  0  and  1) ;  XOR,  OR,  AND;  rotates  left 
and  right  both  through  the  carry  flag  (RAL,  RAR)  and  without  the 
carry  (RLC,  RRC) ;  decimal  adjust  (DAA) ;  and  no-operation  (after 
INR/DCR) .  Since  arithmetic  is  very  common,  the  full  adders  used 
for  addition  and  subtraction  are  tested  with  all  input 
combinations  for  each  adder  (8  combinations  for  each  of  the  8 
adders)  during  the  course  of  the  test.  Note  that  the  compare 
instructions  are  subtracts  as  far  as  the  ALU  is  concerned.  A 
self-contained  subtest  applies  all  input  combinations  to  each  of 
the  ALU's  XOR,  OR,  and  AND  logic  function  gates  (4  combinations 
for  each  of  the  8  gates  for  each  function) .  (Users  not 
concerned  with  the  logic  functions  could  omit  this  subtest.) 
The  ALU *8  rotates  are  tested  for  functionality  by  performing 
each  of  the  four  different  rotates  once;  this  seems  like  a 
minimal  test,  but  since  the  exact  implementation  of  these 
functions  is  unknown,  what  is  optimal?  Also,  the  rotates  are 
not  one  of  the  most  commonly  used  ALU  functions,  so  a  longer 
test  seems  unjustified.  The  (BCD)  decima:  adjust  function  is 
tested  for  four  cases:  no-adjustment,  adjustment  due  to  the 
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carry  flag  CY=1,  adjustment  due  to  the  auxiliary  carry  flag 
AOl,  and,  finally,  for  adjustment  due  to  a  digit  greater  than 
nine.  This  test  also  verifies  that  the  AC  flag  can  be  both  one 
and  zero  (providing  overlap  with  flag  testing) . 

The  8080  register  array  consists  of  the  user  registers  B&C, 
D&E,  and  H&L,  plus  the  stack  pointer  SP,  program  counter  PC,  the 
W&Z  internal  registers,  a  16-bit  increment/decrement  circuit, 
and  a  16-bit  address  latch  (plus  multiplexers  and  demultiplexers 
for  register  select) .  Registers  B,C,D,E,H,L,  and  SP  are  tested 
with  the  patterns  described  in  Section  2.7  of  this  report.  It 
is  important  to  note  that  the  8080  XCH6  instruction  (exchange 
D&E  with  H&L)  operates  by  switching  the  internal  addressing  of 
the  DE  and  HL  register  pairs,  and  does  not  actually  move  any 
data  at  all  [3] .  Thus  to  test  these  registers'  RAM  cells,  one 
must  be  wary  of  XCHG's,  or  the  test  coverage  will  not  be  what  it 
seems.  The  register  test  patterns  used  for  SP  (hex  AAAA,  5555, 
and  0000/FFFF)  are  also  (while  testing  SP)  applied  to  the 
array's  address  latch  and  inc/decrement  circuit.  This  should 
detect  any  stuck  bits  or  shorts  between  adjacent  bits  in  these 
elements.  The  address  buffer  (which  drives  the  address  bus  from 
the  address  latch),  however,  cannot  be  tested  with  these 
patterns,  since  (for  meaningful  results)  only  valid  memory  (and 
I/O)  addresses  can  be  applied  (without  adding  more  test 
hardware).  The  same  restriction  applies  to  the  program  counter 


PC.  In  addition,  the  W&Z  internal  registers  are  not  tested  with 
these  patterns  either,  despite  the  fact  that  they  can  be  loaded 
via  XTHL  (exchange  top  of  stack  with  H&L) .  This  is  because  W&Z 
are  used  for  all  branching  (justps,  calls,  returns,  and  RSTs) 
except  PCHL,  which  is  unconditional.  Thus  though  a  stuck- 
at/short  in  W&Z  could  be  detected,  the  conditional  branch  that 
must  be  used  for  verification  would  probably  jump  to  the  wrong 
address.  (Also,  the  test  would  require  a  fair  amount  of  time  as 
XTHL  is  the  slowest  8080  instruction.)  Note  that  W&Z  are 
implicitly  tested  to  some  extent  since  the  test  includes  an  XTHL 
and  numerous  branches;  PC  is  similarly  tested  as  it  steps 
through  the  self-test  programs. 

The  increment/decrement  circuit  is  tested  for  worst  case 
transitions  (decrementing  0  and  incrementing  -1) ,  for 
carry/borrow  to/from  the  high  order  register  of  the  pair,  and 
for  no  carry/borrow  propagation.  Also,  some  additional  testing 
is  performed  while  testing  stack  operations  and  by  the 
incrementing  of  PC  after  each  fetch.  Finally,  register  select 
logic  is  tested  by  using  different  and  logically  distinct 
patterns  in  the  various  user  registers,  as  explained  in  Section 
2.3. 

The  6080  also  contains  several  other  8-bit  registers:  the 
accumulator  A,  accumulator  latch  ACT,  a  TMP  register, 
instruction  register  IR,  and  a  data  buffer/latch  (driving  the 
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data  bus).  The  first  three.  A,  ACT,  and  TMP,  are  used  for 
almost  all  ALU  operations  and  are  tested  (for  stuck-ats  and 
shorts  between  adjacent  bits)  with  the  register  test  patterns 
(described  in  Section  2.3)  during  the  course  of  various 
arithmetic  instructions  (overlapped  with  ALU  testing) . 
Sufficient  opcodes  are  applied  to  IR  to  verify  that  it  too  is 
free  of  stuck-ats  and  shorts  between  bits.  The  data  bus 
buffer/latch  is  also  tested  for  these  faults  by  the  opcodes  and 
data  bytes  read  from  memory  (latch)  and  by  the  patterns  output 
by  the  CPU  for  testing  memory  and  stack  writes  (buffer) .  The 
8228  bidirectional  data  paths  are  also  tested  by  these  data 
transfers.  The  8-bit  increment/decrement  function  is  tested  in 
the  same  manner  as  the  16-bit  inc/decrement  circuit,  with  worst 
case  transitions  (incrementing  -1  and  decrementing  0)  and 
various  others.  Finally,  the  accumulator's  complement  function 
(CMA)  is  also  tested  for  any  stuck-ats  or  shorts  (between 
adjacent  bits)  while  generating  patterns  for  other  uses 
(overlap) . 

The  flags  (CY,  AC,  even  Parity,  Sign,  fc  Zero)  are  tested  by 
verifying  each  as  true  (1)  and  false  (0) .  This  is  simultaneous 
with  the  testing  of  conditional  jumps:  JZ,  JNZ,  JM,  JP,  JC,  and 
JNC  are  all  verified  for  both  branch  and  no-branch.  The 
remaining  two,  JPE  and  JPO,  are  tested  for  no-branch  only  since 
the  Parity  flag  is  not  commonly  used  and  the  time  seemed  better 
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spent  elsewhere.  The  AC  flag  is  tested  while  testing  the 
decimal  adjust  function  (DAA) .  The  CY  and  Z  flags  are 
considered  most  important  and  as  such  are  tested  most 
thoroughly.  CY  is  the  easiest  to  test,  since  it  is  used  by  adds 
with  carry,  subtracts  with  borrow,  certain  rotates,  and  decimal 
adjust.  Some  additional  testing  of  all  flags  occurs  while 
testing  the  PUSH/POP  PSH  instructions. 

The  8080  instruction  decoding,  implemented  by  ROM,  is 
tested  by  exercising  all  possible  classes  of  instructions  and 
all  possible  micro-operations.  Also,  the  test  includes 
instructions  with  zero,  one,  and  two  bytes  of  immediate  data, 
and  instructions  with  an  immediate  address  (such  as  LDA) . 
Likewise,  all  forms  of  addressing,  direct,  register,  register 
indirect,  and  immediate,  are  exercised.  Despite  the  fact  that  a 
decoder  ROM  fault  may  show  up  for  only  a  single  instruction,  the 
self-test  does  not  cry  to  execute  all  instructions.  Rather  the 
test  exercises  classes  of  instructions,  where,  for  example,  ADD 
r,  ADD  M,  and  ADI  xxx  form  a  class,  DCX  rp  form  another,  and 
XCHG  is  a  class  of  its  own.  All  classes  of  instructions  are 
exercised  except  for  DI,  HLT,  IN,  and  OUT  (since  extra  hardware 
would  b«  required  to  test  these),  and  conditional  calls/returns. 
IN  and  OUT  would  be  tested  in  I/O  port  tests  and/or  status 
reporting  if  memory  mapped  I/O  is  not  employed.  A  test 
containing  conditional  calls  and  returns  has  been  implemented, 
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with  all  but  the  parity  conditions  tested  for  both  call  (return) 
and  no-call  (no-return).  However,  the  extra  time  required  is 
considerable  (about  300  clock  cycles)  so  that  user  priority  will 
determine  whether  or  not  to  use  this  version  of  the  self-test. 
More  importantly,  the  self-test  exercises  all  micro-operations 
except  those  covered  only  by  DI,  HLT,  IN,  and  OUT;  this 
exercises  most  of  the  decoding  and  control  logic  of  the  CPU. 
Refer  to  Appendix  G  for  a  list  of  the  8080  micro-operations. 

The  data  paths  connecting  the  various  elements  of  the  CPU 
are  tested  (for  stuck-ats/shorts)  "in  the  process  of  testing  the 
elements  themselves.  Also,  as  was  mentioned  in  Section  2.2,  the 
micro-operations  were  developed  with  the  data  paths  in  mind;  so 
all  data  paths  are  exercised  to  some  degree.  The  weakest  point 
is  the  path  to  the  address  buffer  which,  as  stated  before,  is 
restricted  to  valid  memory  and  I/O  addresses  (for  meaningful 
results) . 

Tests  were  combined  where  possible.  For  example,  on  page 
A. 4,  the  portion  of  the  test  between  OKO  and  OKI  executes  the 
DCX,  ADD,  and  ACI  to  set  the  carry  and  zero  flags  and  EVEN 
parity.  The  JNZ,  JNC,  JPO  instructions  verify  the  correct 
operation  of  instructions,  flags,  and  conditional  jumps.  Note 
that  the  JZ  to  OKI  is  followed  by  a  JMP  error  in  case  the  JZ 
fails.  The  RST  ERX  is  yet  another  branching  mechanism  that  may 
work  if  the  JMP  fails.  Finally,  the  HLT  should  hang  up  the 
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program  if  no  transfer  at  all  is  executed.  The  RST  ERX 
transfers  control  to  one  of  8  vectors  in  low  memory,  where  a 
copy  of  the  ERR  routine  is  located. 

Similarly,  segments  from  OKI  to  OKS  verify  other 
combinations  of  operations.  The  segment  0K5  verifies  DAA,  DAD, 
INX,  and  other  register  and  ALU  operations.  As  a  final  check, 
the  contents  of  all  registers  are  verified  by  adding  them 
together  modulo  256  with  end  around  carri  and  checoing  for  the 
expected  sum.  This  tests  for  multiple  register  selects. 

The  other  instruction  tests  are  documented  in  appendix  A, 
pages  A. 2  to  A. 10. 

2.6.4  ROM  Test  Program 

A  ROM  test  using  checksums  formed  by  modulo  256  addition 
with  carries  added  back  to  the  LSB  (as  described  in  Section 
2.5.2)  has  been  implemented  for  the  8080  processor.  The 
algorithm  is  passed  the  start  address  of  the  block  of  ROM  to 
test  and  forms  a  sum  of  AA  hex  for  a  GO  pass.  The  test  routine 
object  code  occupies  only  64  bytes  of  memory  and  runs  in  about 
45  N  clock  cycles,  where  N  is  the  number  of  bytes  of  ROM  to 
test.  Thus  128  bytes  of  ROM  can  be  tested  in  a  single  pass  of 
just  under  3  milliseconds  (with  a  2  MHz  clock).  See  page  A. 16. 

A  sample  program,  written  in  Microsoft  BASIC,  for 
calculating  the  checksum  needed  for  each  ROM  segment  is  listed 
in  Appendix  H.  The  program  requests  the  segment  size  and 
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desired  final  sum  for  flexibility;  these  should  be  128  and  170 
decimal  (AA  Hex) ,  respectively,  to  match  the  self-test  program 
listed  in  Appendix  A.  The  CHKSUM  program  accepts  an  INTEL  ASCII 
format  object  file  as  input.  This  object  file  should  have  a 
aero  byte  where  each  checksum  byte  will  be  placed;  the  zeroes 
must  then  be  changed  to  the  appropriate  checksums,  and  the  file 
reassembled  prior  to  burning  the  ROM. 
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2.6.5  RAM  Test  Program 

A  MOVI  RAM  test  and  both  quick,  nondestructive  RAM  tests 
described  in  Section  2.5.3  have  been  coded  for  the  8080.  The 
thorough  MOVI  (Appendix  F)  test  requires  almost  20  seconds  per 
IK  of  RAM  (for  a  2  MHz  clock)  and,  as  stated  earlier,  tests  all 
of  contiguous  RAM  at  once.  The  first  quick  test,  which  tests 
RAM  location  by  location  (A. 17) ,  requires  about  150N  clock 
cycles  to  test  N  locations,  or  about  75  milliseconds  per  IK. 
The  32  byte  segment  used  in  the  program  (A. 17)  requires  2.3 
milliseconds  to  execute.  The  second  quick  test,  which  tests  two 
successive  RAM  bytes  at  a  time,  requires  about  235N  clock  cycles 
for  N  locations,  or  about  120  milliseconds  for  IK.  Both  of 
these  tests  are  passed  the  start  address  of  the  RAM  segment  to 
be  tested  to  allow  segment  testing.  Each  of  the  nondestructive 
test  routines  requires  less  than  100  bytes  of  object  code,  while 
MOVI  requires  about  200  bytes.  The  first  nondestructive  test  is 
included  in  the  self-test  program  listed  in  Appendix  A;  it  was 
chosen  for  its  high  speed. 

2.6.6  1/0  Ports  Test  Program 

The  8080  has  two  software  programmable  I/O  port  chips:  the 
8251  USART  for  serial  I/O,  and  the  8255  for  parallel  I/O. 
Nondestructive  tests  have  been  coded  for  both  chips  using  memory 
mapped  I/O  so  that  the  same  test  routine  may  be  used  to  test 
several  different  8251's  (or  several  8255's).  However,  the 
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routines  may  be  easily  converted  to  discrete  I/O  (using  IN  and 
OUT) . 

The  asynchronous  mode  of  the  8251  is  tested  and  has  been 
modelled  for  simulation.  As  described  in  Section  2.5.4,  the 
test  consists  of  an  I/O  test,  a  break  send/detect  test,  and  an 
overrun  error  detect  test.  Unfortunately,  not  all  versions  of 
the  8251  have  the  break  detect  capability  [4,5];  the  break  is 
transmitted  and  wrapped  around  to  the  serial  input,  but  a 
framing  error  is  detected  instead  of  the  break.  For  these  chips 
the  break  test  has  become  a  break  send/framing  error  detect 
test.  The  8251  test  routine  requires  about  128  bytes  of  object 
code;  its  execution  time  depends  upon  the  character  length  and 
baud  rate  selected.  With  one  stop  bit,  8  bit  characters,  no 
parity,  and  at  9600  baud,  the  8251  test  requires  just  under  8 
milliseconds.  Therefore,  it  was  divided  into  two  parts 
requiring  about  4  ms  each.  (See  p  A. 19) 

An  8255  test  has  been  coded  to  test  Mode  0  operation  (basic 
I/O  with  no  strobes/handshaking) (See  page  A. 11).  Although  the 
8255  remains  in  Mode  0  throughout,  it  changes  the  port 
configurations  (i.e.,  changes  which  ports  are  inputs  and  which 
are  outputs).  However,  the  test  restores  the  8255  to  its 
original  configuration,  which  must  be  known  in  advance.  Before 
the  test  commences,  all  wraparound  and  isolation  buffers  are 
tri-stated  (isolating  the  external  device);  then  a  pattern  is 


written  to  each  port.  This  is  a  no-op  if  the  port  is  defined  as 
an  input,  while  if  it  is  an  output,  the  pattern  is  latched  and 
can  be  read  back  by  reading  that  port.  Each  port  is  then  read 
back;  if  it  was  an  input,  FF  hex  (all  ones)  is  read  (since  the 
lines  driving  the  inputs  are  tri-stated) .  If  the  port  was  an 
output,  the  pattern  is  read  back;  note  that  if  neither  value  is 
read  back,  there  is  a  fault  and  a  NO-GO  result  is  generated. 

The  first  part  of  the  test  routine  tests  the  8255' s  three 
I/O  ports  (A,  B  &  C)  and  the  data  paths  involved  for  stuck  bits 
or  shorts  between  bits  as  well  as  testing  the  8255 's  basic 
functionality.  The  test  defines  one  port  as  output  and  the 
other  two  as  input,  and  then  outputs  test  patterns  and  verifies 
that  they  have  been  read  back  correctly  through  the  two  input 
ports.  Each  port  has  a  turn  as  output  port,  as  shown  below: 

Output  port  Input  ports  Patterns  used  (hex) 


A 

B,  C 

55, 

AA, 

00 

B 

A,  C 

CC, 

66, 

33 

C 

A,  B 

D9, 

6C, 

36 

The  second  part  of  the  test  checks  the  Port  C  single  bit 
set/reset  function.  Each  bit  is  set  (verified)  and  reset;  the 
test  then  verifies  that  setting  a  set  bit  and  resetting  a  zero 
bit  have  no  effect.  The  patterns  in  Port  C  are  read  back  for 
verification  through  Port  B.  The  total  test  routine  requires 
approximately  300  bytes  of  object  code  and  takes  between  1700 


and  1800  clock  cycles  to  execute  (0.85  to  0.90  milliseconds  for 
a  2  MHz  clock) ,  depending  upon  the  original  configuration. 
Therefore,  this  test  was  combined  with  the  CPU  test  to  make  a  2 
ms  segment. 

A  self- test  methodology  has  been  described  for 
microprocessor  systems  in  general  and  specific  algorithms  for  an 
8080  system  have  been  discussed.  The  methodology  has  been 
developed  under  the  constraints  of  minimum  additional  hardware, 
minimum  impact  on  system  users,  and  has  been  tailored  to  quick, 
periodic,  transparent  tests.  Some  elements/functions  are 
untestable  under  these  constraints  (as  was  Halt) ,  or  can  be 
given  only  a  partial  test  (as  for  RAM) .  The  test  procedures 
proposed  follow  the  'start-big'  approach  and  so  attempt  to 
overlap  testing  one  element/function  with  testing  others. 
Overlap  is  quite  important  under  the  above  constraints  in  order 
to  maximize  fault  coverage  while  minimizing  testing  time. 
Unfortunately,  this  overlap  makes  automatic  generation  of  tests 
most  difficult,  but  research  toward  this  end  is  desirable. 

2.7  Organization  of  Self-Test  Segments 

The  overall  system  self-test  is  organized  as  a  sequence  of 
short  periodic  test  segments.  With  a  2  MHz  processor  clock  and 
fast  memory  that  does  not  require  WAIT  states,  the  .execution 
time  of  each  segment  is  as  follows: 

where  m  *  (ROM  memory  size  in  bytes) /128 
n  -  (RAM  memory  size  in  bytes) /32 

Segment  (1)  Tests  CPU  and  8255  (2  ms) 
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Segment  (2)  Tests  first  128  bytes  of  ROM  (3  ms) 
Segment  (3)  Tests  next  128  bytes  of  ROM  (3ms) 


Segment  (m+1)  Tests  last  128  bytes  of  ROM  (3ms) 
Segment  (m+2)  Tests  first  32  bytes  of  RAM  (2.5ms) 
Segment  (m+3)  Tests  next  32  bytes  of  RAM  (2.5ms) 


Segment  (m+n+1)  Tests  last  32  bytes  of  RAM  (2.5ms) 

Segment  (m+n+2)  Tests  8251  (4ms  at  9600  baud) 

Segment  (m+n+3)  Tests  8251  (4ms  at  9600  baud) 


The  total  test  time  is  3m+2.5n+10  milliseconds.  For 
example,  for  a  system  with  16K  of  RAM  and  2K  of  ROM,  the  total 
test  time  would  be  1338  ms.  The  CPU  test  uses  only  2ms  of  the 
total  time.  The  8251  uses  4  ms,  the  ROM  requires  48  ms  and  the 
RAM  requires  the  rest  (1280  ms) .  The  test  is  executed  in  m+n+3 
=  531  sequential  segments. 

2.8  Hardcore  Assumptions 

The  self-test,  as  mentioned  previously,  cannot  test  all  CPU 
elements/functions  completely  without  special  extra  hardware. 
Those  elements  not  tested  are:  the  HLT  instruction;  the  DI 
(disable  interrupts)  instruction;  the  IN  and  OUT  instructions 
(since  memory  mapped  1/0  is  employed) ;  conditional  calls  and 
returns  (an  enhanced  CPU  test  verifying  these  calls/returns  has 
been  coded,  but  was  not  simulated);  the  program  counter  (PC)  and 
address  buffer  (since  only  valid  addresses  may  be  used  for 
meaningful  results);  and  the  WZ  register  pair.  Faults  in  the 
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three  elements  may  be  detected  by  a  hardware  timeout 
should  the  program  lose  control  due.  to  faulty  addresses. 
Finally,  the  8080's  timing  and  control  circuitry  cannot  be  self- 
tested  Urectly  (without  special  hardware) . 
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3.  FAULT  SIMULATION 


One  o£  the  difficulties  in  developing  self-tests  for  LSI 
systems  is  trying  to  rate  the  effectiveness  of  the  software. 
When  one  reads  articles  on  self  test  development  for  LSI 
systems,  the  authors  are  usually  mute  on  this  point  or  make 
vague  statements  such  as  "the  test  routines  were  shown  to  be 
effective."  The  reason  for  this  is  that,  presently,  the  only 
known  way  of  testing  the  effectiveness  of  self-test  software  is 
to  conduct  "fault  injection  experiments."  One  can  either  run 
these  experiments  with  a  real  hardware  system  or  through 
simulation.  using  a  hardware  system  is  not  feasible  because 
obtaining  LSI  devices  with  known  internal  defects  is  much  more 
difficult  than  obtaining  good  devices.  Simulation  does  provide 
an  answer,  but  there  are  problems  here  also.  LSI  devices 
contain  thousands  of  gates,  thus  using  traditional  gate  level 
simulation  techniques  can  present  great  difficulties.  The 
biggest  problem  is  that  accurate  gate  level  models  of  LSI 
devices  are  usually  known  only  by  the  manufacturer  and  in  most 
cases  they  are  unwilling  to  divulge  this  information.  Secondly, 
even  given  a  gate  level  model  of  an  LSI  system,  the  simulations 
require  too  much  host  CPU  time,  i.e.  money,  when  validating 
self-test  software.  The  only  solution  to  this  problem  is  to 
develop  a  simulation  model  at  a  higher  level.  During  the  past 
several  years  at  VPI,  we've  developed  an  approach  to  higher 
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levex  simulation  known  as  chip  level  simulation.  In  chip  level 
simulation,  the  internal  microperations  of  a  device  and  the 
timing  characteristics  of  the  signals  at  its  interface  pins  are 
simulated.  This  is  done  without  modeling  the  detailed  internal 
gate  structure  of  the  chip. 

The  simulation  language  that  we  employ  is  called  GSP 
(General  Simulation  Program) .  It  was  developed  under  previous 
U.  S.  Navy  research  contracts.  It  has  been  used  on  this 
contract  and  we  are  also  using  it  to  do  fault  modeling  for  the 
NASA-Langley  Research  Center. 

We  have  found  GSP  to  be  a  very  effective  tool  for  the  fault 
modeling  required  by  this  contract.  As  will  be  detailed,  using 
GSP,  we  were  successful  in  modeling  the  microprocessor  system 
and  conducting  the  required  fault  injection  experiments. 

3.1.  A  Description  of  the  General  Simulation  Program  (GSP) 

The  General  Simulation  Program  (GSP)  is  a  general  purpose 
simulation  program  designed  specifically  to  simulate  LSI  devices 
at  the  chip  level,  i.e.  internal  device  micro-operations  and 
detailed  interface  signal  timing  are  simulated.  The  program  is 
written  in  FORTRAN  to  insure  portability.  Presently  the  system 
runs  in  either  a  batch  (MVS)  or  interactive  (CMS)  mode  on  an  IBM 
3032  Processor.  An  optimizing  compiler  (G1-HX(2))  is  used  to 
speed  up  the  simulation. 
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When  utilizing  the  GSP  system  one  goes  through  the 
following  three  phases: 

Phase  1  -  Chip  Description.  The  user  models  the  device  at 
the  chip  level  (an  example  of  this  is  given  below)  and  codes  its 
description  using  the  GSP  assembly  language.  This  code 
description  is  then  processed  by  the  GSP  assembler  to  produce  an 
integer  microcode  file  which  can  be  used  in  any  subsequent 
simulation  requiring  that  device. 

Phase  2  -  Interconnect  Description.  The  user  edits  an 
interconnect  description  file  which  is  used  to  link  the 
microcode  descriptions  of  the  individual  modules  into  a  total 
system  microcode  description.  This  description  can  be  used  for 
all  subsequent  simulations  of  the  particular  system. 

Phase  3  -  Simulation.  External  system  inputs  are  specified 
and  simulation  is  begun  and  repeated  as  necessary. 

The  process  of  modeling  and  coding  a  "sample"  module  is 
illustrated  in  Figures  3.1  through  3.4. 

The  sample  module  is  an  8  bit  register  with  buffered 
outputs.  Data  is  clocked  into  the  register  on  the  fall  of  the 
strobe  (STB) .  The  ouput  buffers  are  enabled  (EN  *  1)  when  the 
input  select  function  (DS1  DS2)  is  true. 

The  first  step  in  the  modeling  process  is  to  examine  the 
chip  description  and  timing  specifications  to  identify  module 
events.  As  shown  in  Figure  3.1,  the  sample  module  has  a  55  NS 
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delay  (tgD)  from  the  fall  of  the  strobe  until  data  appears  on 
the  ouputs  (assuming  the  buffers  are  enabled) .  Also,  there  is  a 
45  NS  delay  (tED)  specified  from  the  presence  of  the  enabling 
input  logic  condition  (DS1  DS2)  until  ouput  data  appears. 

If  the  buffer  delay  is  10  NS,  then  three  delay  events  can 
be  identified:  (1)  negative  strobe  transition  to  register  self 

call  (45NS) ,  (2)  positive  enable  transition  to  enable  self  call 
(35NS) ,  and  (3)  self  calls  to  data  output.  The  term  "self 
calls"  refers  to  the  fact  that  after  the  module  routine  identifies 
either  of  the  two  external  events  Cll  or  (21,  it  causes  an  event 
to  be  placed  in  the  time  queue  which  will  call  the  module  routine 
in  a  specified  number  of  nanoseconds.  Once  called,  the  routine 
will  schedule  the  register  content  to  appear  in  the  outputs  after 
10  NS,  provided  that  the  buffers  are  enabled. 

Figure  3.2  illustrates  the  second  step  in  the  modeling 
process:  generation  of  the  module  flow  chart.  We  have  found 
this  step  in  the  modeling  process  to  be  very  important  in 
assuring  an  accurate  model.  A  good  deal  of  time  can  be 
fruitfully  spent  in  this  phase  before  proceeding  to  the  coding 
phase. 
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Timing  Specifications: 


Events: 

1.  Neg  strobe  transition  -  register  self  call  (45  ns) 

2.  Pos  enable  transition  -  enable  self  call  (35  ns) 

3.  Self  calls  to  output  (10  ns) 

Figure  3.1  Sample  Module  Specifications 
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For  the  example  under  discussion,  the  flowchart  illustrates 
the  logical  structure  of  the  model.  After  the  enable  (EH) 
signal  is  computed,  a  check  is  made  to  see  if  either  the  enable 
or  the  strobe  events  have  occurred.  Note  that  the  events  are 
detected  by  comparing  the  present  value  of  a  signal  with  the 
value  of  the  signal  that  was  stored  the  previous  time  the  module 
was  called  (e.g.  STB  vs  STBO) .  If  either  of  the  events  has 
occurred,  an  appropriate  self  call  is  scheduled.  Also,  the 
value  of  the  data  or  signal  involved  is  "carried  along"  with  the 
self  call  event  for  later  storage. 

The  next  section  of  the  flow  chart  checks  for  either  an 
enable  self  call  (ENSC)  or  a  data  register  self  call  (DRSC) .  If 
DRSC  -  1,  the  data  register  is  .pdated  using  the  previous  value 
of  the  data  input  value  that  was  "carried  along"  with  the  data 
register  self  call.  Next,  the  value  of  the  delayed  enable  (END) 
is  checked.  If  END  -  1,  the  data  outputs  are  scheduled  to  take 
on  the  value  of  the  data  register  in  10  NS.  If  END  »  0,  the 

data  outputs  will  be  forced  to  the  all  ones  configuration 
simulating  the  high  impedance  state.  The  final  activity  in  the 
flowchart  is  the  updating  of  the  "old  values"  of  EN  (ENO)  and 
STB  (STBO) .  After  this,  the  module  procedure  is  exited. 

The  final  step  is  the  coding  of  the  module  description 
using  the  GSP  assembly  language.  This  is  illustrated  in  Figure 
3.3. 
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Note  that  the  description  contains  a  declaration  section 
and  a  section  containing  module  micro-operations.  The 
declaration  section  specifies  registers  (REG) ,  pin  connections 
(PIN)  and  events  (EVW) .  Module  micro-operations  are  specified 
using  a  rather  normal  looking  assembly  language  except  for 
instructions  like:  MOV(WIO)  D,  DO.  This  instruction  causes  the 
contents  of  the  D  register  to  be  moved  to  the  ouput  in  10 
nanosJc . 

Figure  3.4  shows  the  form  of  the  integer  microcode  file  for 
the  sample  module. 

This  section  of  the  report  has  given  only  a  cursory 
introduction  to  the  General  Simulation  Program  (GSP)  .  For  more 
information  the  reader  is  referred  to  reference  6. 
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DECLARATION  SECTION: 


REG (8)  D  ; SAMPLE  MODULE,  8  BIT  CLOCKED  REGISTER 
BEG(l)  TEMPI, EN,ENO, STBO  jTRI  STATE  OUTPUT  WITH  ENABLE  CONTROL 
PIN  Did, 8), 00(9.16), DS1(17),NDS2(18),STB(19)  ;PIN  SPECIFICATION: 
PIN  DID(20,27),Efa)(28),EX(61),ENSC(62),DRSC(63>  jPSEUDO  PINS 
EVW(500)  W10U0),W35(35),W45(45) 


MODULE  MICROPERATIONS: 


MOV  NDS2, TEMPI  j COMPUTE  EN=DS1.NDS2' 

COM  TEMPI 

AND  DS1, TEMPI, EN 

ENC:  XOR  EN,ENO,  TEMPI  ; CHANGE  IN  OUTPUT  ENABLE? 

BEQ  TEMPI, STBC 

M0V(W35)  #1,ENSC  ; SCHEDULE  ENABLE  SELF  CALL  IN  35NS 
MOV ( W3 5 )  EN,END  ; CARRY  ALONG  CURRENT  ENABLE  VALUE 
STBC : MOV  STB, TEMPI  ; COMPUTE  STB' . STBO 

COM  TEMPI 

AND  TEMPI, STBO, TEMPI 

BEQ  TEMP  ,FLGCK  ;NEG  STROBE  TRANSITION? 

M0V(W45)  #1,DRSC  ; SCHEDULE  REG  SELF  CALL  IN  45NS 
M0V(W45)  DI,DID  ; CARRY  ALONG  THE  CURRENT  INPUT  VALUE 
FLGCK : OR  ENSC,DRSC, TEMPI 

BEQ  TEMPI, UPDATE  ; EITHER  SELF  CALL  FLAG  SET? 

MOV  #0,ENSC  ; RESET  FLAG 

BEQ  DRSC.OOT  ; CHECK  FOR  REGISTER  SELF  CALL 
MOV  M.dRSC  ;  RESET  FLAG 

MOV  DID,D  j UPDATE  D  REGISTER 

OUT:  BEQ  END,HIZ  ; CHECK  OUTPUT  ENABLE 

MOV(WIO)  D,DO  ; DO=D  IN  IONS 


; CHANGE  IN  OUTPUT  ENABLE? 


•  »  »  v/unuvi 

BEQ  DRSC^Ou 
MOV  #U.dRSC 
MOV  DID,D 


MOV  DID,D 
OUT:  BEQ  END,HIZ 
MOV(WIO)  D,DO 
BRU  UPDATE 

HIZ:  MOV(WIO)  #225,D0 
UPDATE: MOV  EN,ENO 
MOV  STB, STBO 
MOV  #0,EX 
END 


; D0=ALL  l'S  IN  IONS 
; UPDATE  VARIABLES 

^  EXIT  MODULE 


FIGURE  3.3  MODULE  DESCRIPTION 
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Microcode 
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Module  Microcode  File 


3.2.  The  Simulation  Model  for  8080  System 

The  system  that  was  modeled  consisted  of  the  same  chips 
that  are  in  the  hardware  system:  (1)  8080  microprocessor  (2) 
8228  System  Controller  and  Bus  Driver  (3)  Semiconductor  Random 
Access  Memory  (RAM)  (4)  Read  Only  Memory  (ROM)  (5)  8251 
Programmable  Communicaton  Interface  (UART)  and  (6)  8255 
Programmable  Peripheral  Interface  (Parallel  Port).  The  real 
system  also  contains  an  8224  clock  chip,  however  for  simulation 
purposes  this  was  considered  to  be  part  of  the  microprocessor. 
In  addition  to  the  above  six  models,  the  gating  used  to  perform 
address  selection  was  grouped  together  to  form  a  Select  Module. 
Finally  the  bus  interconnect  between  the  chips  was  also  modeled 
as  a  module.  Figure  3.5  below  shows  a  diagram  of  the  system 
model. 

As  pointed  out  in  section  2,  the  system  test  scheme  employs 
wrap  around  from  I/O  outputs  to  I/O  inputs.  It  was  not 
necessary  to  model  this  wrap  around  as  separate  modules  in  that 
we  were  able  to  use  our  regular  method  of  interconnect 
specification. 

3.3.  The  Modeling  Process 

The  development  of  the  simulation  model  for  a  computer 
system  consists  of  steps  which  are  analogous  to  hardware 
development.  Models  for  the  individual  chips  are  first 
developed  and  checked  out.  This  model  development  consists  of 
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four  steps:  (1)  examination  of  the  manufacturer's 
specifications  (2)  development  of  a  model  flow  chart  (3)  coding 
of  the  model  (4)  assembling  the  model  code  to  produce  a  "micro 
code"  file.  This  process  was  illustrated  in  section  3.1  for  a 
sample  module. 

The  development  of  the  models  for  the  test  system  followed 
the  same  four  steps.  Model  development  and  model  checkout  for 
LSI  chips  is  a  sophisticated  process,  requiring  that  the  modeler 
have  a  thorough  understanding  of  the  chip  logic.  We  estimate 
that  approximately  7  man  months  of  effort  were  expended  in  model 
development.  We  do  not  discuss  each  model  in  detail  in  this 
report.  However,  in  appendix  B  the  model  flow  charts  for  the 
test  system  are  given.  Appendix  C  gives  the  assembly  language 
description  for  each  module.  At  the  present  time,  a  separate 
document  discussing  modeling  techniques  is  in  the  writing 
process.  We  will  forward  this  to  RADC  when  completed. 
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8251 


8255 


Figure  3.5 

System  Simulation  Model 
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3.4.  Development  of  the  System  Model 

Once  the  individual  models  have  been  coded  and  checked  out, 
they  are  merged  to  form  a  system  microcode  file.  Figure  3.6 
illustrates  the  process.  It  assumes  that  individual  microcode 

0 

files  have  been  prepared.  These  files  are  then  merged  to  form 
the  LINK  file.  The  LINK  file  holds  the  microcode  for  the  entire 
system.  In  addition  it  also  is  used  to  maintain  the  state  of 
all  system  signals  initially  and  as  simulation  progresses.  The 
merging  of  module  descriptions  to  form  the  LINK  file  is 
performed  automatically  upon  command. 

Another  file,  the  DATA  file,  contains  necessary  information 
on:  (1)  module  interconnection  (2)  initial  signal  values  (3) 
module  input  marking  (4)  input  vector  specification.  The  DATA 
file  for  the  test  system  is  given  in  Appendix  D.  Details  of  how 
to  prepare  the  data  file  are  given  in  reference  6. 

Once  the  LINK  file  and  the  DATA  file  are  in  place  the 
simulation  can  begin.  As  simulation  progresses,  the  state  of 
the  system  is  maintained  in  the  LINK  file.  Specified  system 
outputs  are  routed  to  an  output  file  for  storage.  The 
simulation  output  can  also  be  simultaneously  routed  to  the 
user's  terminal  and/or  printer.  The  above  discussion  implies 
operation  in  an  interactive  computing  system;  however  the 
simulator  can  be  run  in  the  batch  mode  as  well.  In  fact,  most 
of  our  longer  simulation  runs  were  made  this  way. 
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Figure  3.6 


3.5.  Fault  Injection  Experiments 

The  purpose  of  constructing  the  simulation  model  was  to 
conduct  "fault  injection  experiments"  in  order  to  assess  the 
effectiveness  of  the  test  software.  The  first  step  in  the 
process  is  the  injection  of  the  fault  into  the  module  microcode. 
This  is  done  by  assessing  the  effect  the  fault  has  on  the  module 
response  and  then  incorporating  this  effect  into  the  model. 
This  incorporation  is  accomplished  by:  (1)  deleting  module  code 
or  (2)  modifying  module  code  or  (3)  adding  additional  module 
code  or  (4)  some  combination  of  (1),  (2)  and  (3). 

This  contract  was  the  first  time  we  had  ever  done  this  on  a 
large  scale.  Our  approach  to  doing  this  was  therefore  "ad  hoc", 
but  we  will  study  the  overall  results  and  attempt  to  derive 
general  principles  for  fault  insertion. 

A  full  list  of  the  faults  injected  for  each  chip  are  given 
in  appendix  E.  However,  they  can  loosely  be  divided  into  three 
categories: 

(1)  Incorrect  microperations  -  Examples:  "Incorrect 
operation  of  carry  flag  for  subtract  instruction"  (CPU) , 
"multiple  register  select  on  read,  selecting  C  also  selects  L" 
(CPU) ,  "Bit  set/reset  command  clears  Port  C  output  completely” 
(8255) . 

(2)  stuck  at  faults 
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Examples:  "Data  bus  line  2  from  the  8228  stuck  at  zero", 
address  line  ADO  stuck  open  (ROM)",  and  "status  register  stuck 
at  all  zeros"  (8251) . 

(3)  timing  faults. 

Examples:  "Write  pulse  must  be  500NS  to  write  correctly 
instead  of  the  specified  250  MS  (8251)"  or  "Hold  times  for 
address  and  data  had  to  be  too  large — 300MS  from  the  end  of  the 
write  pulse"  (8255) . 

A  basic  question  that  $«<ght  be  asked  is  how  were  the  faults 
chosen.  With  the  very  high  reliability  of  LSI  devices  [7] ,  the 
most  likely  faults  will  be  interconnect  faults,  e.g.  cold  solder 
joints  and  printed  circuit  board  defects.  Therefore,  in  our 
simulation  of  faults,  a  high  priority  was  given  to  interface 
defects:  43  per  cent  of  the  faults  injected  were  interface 
faults. 

In  selecting  interior  chip  faults  to  simulate,  the  ideal 
approach  would  be  to  first  compile  a  list  of  the  most  likely 
faults  from  literature  data  and  information  obtained  directly 
from  the  manufacturer.  The  faults  to  inject  could  then  be 
selected  from  this  list.  In  the  case  of  memory  devices,  failure 
modes  are  well  documented  [2]  so  that  we  were  able  to  do  this. 
For  the  other  chips  in  the  system,  i.e.  the  8080  processor  and 
it's  support  chips,  no  such  data  is  available.  We  contacted 
people  involved  in  fault  simulation  at  INTEL  and  their  reply  was 
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that  they  knew  of  no  fault  history  for  their  chips.  In  light  of 
this  situation,  we  decided  that  the  next  best  approach  was  to 
have  the  simulation  modeler  of  each  chip  select  the  faults,  e.g. 
the  person  who  developed  the  model  for  the  8251  would  compile  a 
fault  list  for  that  chip.  Also,  to  as  great  a  degree  as 
possible,  the  selector  of  the  faults  should  not  be  aware  of  the 
characteristics  of  the  test  programs.  We  followed  these 
guidelines  as  closely  as  possible  given  the  limited  number  of 
people  working  on  the  project  at  one  time  (4-5)  and  believe  we 
were  able  to  select  an  unbiased  set  of  faults  to  test  the  self 
test  software. 

In  conducting  the  actual  injection  experiments  we  wanted  to 
insure  that  the  necessary  fault  information  was  collected.  To 
insure  this,  a  standard  Fault  Injection  Experiment  Record  form 
was  used  for  each  experiment.  Figure  3.7  gives  an  example  of 
this.  The  Fault  Description,  as  its  name  implies,  describes  the 
physical  fault  that  is  inserted,  in  this  example:  "data  line  D0 
to  8251  shorted  to  ground."  The  System  Configuration  category 
lists  the  module  files  that  were  used  for  the  run.  The  Initial 
Conditions  and  Input  categories  are  self  explanatory.  This 
information  is  stored  in  a  DATA  file  so  the  name  of  that  file  is 
specified  here.  The  test  routine  that  was  being  executed  is 
recorded  in  the  "Program  Executed"  category.  A  description  of 
how  the  fault  manifested  itself  is  given  in  the  Fault  Syndrome 
category.  Finally  space  is  given  for  additional  comments. 
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We  did  not  include  the  Pault  Experiment  Record  for  each 
experiment  in  the  report.  (They  are  on  file  in  the  Department 
of  Electrical  Engineering  at  VPI&SU.)  Instead  we  prepared  for 
this  report,  as  appendix  E,  a  Fault  Experiments  Summary.  The 
summary  has  an  entry  for  each  experiment.  The  entry  contains  a 
"description  of  the  fault”  and  the  test  results.  Test  results 
are  classified  as  detected,  program  control  lost,  or  not 
detected.  Under  our  system  test  concept,  a  fault  can  be 
detected  in  two  ways:  (1)  the  test  routine  detects  the  fault  or 
(2)  the  test  routine  hangs  up  in  an  infinite  loop  due  to  lack  of 
response  from  some  section  of  the  hardware.  In  this  second 
case,  a  "watch  dog  timer"  would  time  out  indicating  a  system 
failure.  Loss  of  program  control  means  that  the  processor 
receives  faulty  instruction  data  from  the  ROM  and  therefore  is 
no  longer  executing  the  test  routine.  It  is  highly  probable,  we 
believe,  that  a  time  out  will  occur  in  these  cases  also,  but  we 
list  them  separately  since  the  probability  of  detection  is  not 
unity. 
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Fault  Injection  Experiment  Record 

Date i  8-25-1 

Fault  Description:  Interconnect  Fault  I8251IB,  Data  line  D 9  to  8251 
shorted  to  ground 
System  Configuration:  SYS 51 
RAM32RB 
A8255V6 
B8228 
A8080N 
CSL 
BUS 

TEST8251  (ROM) 

A8251V5 

Initial  Conditions  Input  Program  Executed 

A8251IB  DATA  A1  TEST8251  SOR  Al 

Fault  Syndrome:  Mode  word  and  command  word  to  8251  were  modified  to 
4C  and  14  respectively  instead  of  4D  and  15. 

Test  incomplete.  Processor  hangs  up.  Hardware  timer 
should  detect  the  fault. 

Comments : 


Figure  3.7 
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3.6  Analysis  of  Fault  Coverage 

Table  3.7  below  gives  a  numerical  summary  of  the  results  of 
the  fault  injection  experiments. 


System 

NOT 

Component 

PET. 

PCL 

PET. 

T< 

CPU 

33 

2 

1 

36 

8228 

4 

2 

6 

BUS 

3 

3 

ROM 

1 

3 

1 

5 

RAM 

2 

2 

3 

7 

8255 

31 

7 

38 

8251 

21 

2 

23 

Totals 

97" 

T7 

IS 

118 

Percent 

78 

8 

14 

100 

Table  3.7 

The  data  shows  that  of  the  118  faults  injected,  92,  or  78 
percent  would  definitely  be  detected,  102,  or  86  percent  would 
probably  be  detected,  while  16,  or  14  percent,  would  definitely 
go  undetected.  The  table  also  shows,  in  particular,  the 
sensitivity  that  the  system  has  to  faults  in  the  data  path 
involving  the  RON,  BUS  and  8228.  Of  the  total  of  15  faults 
injected  in  these  three  modules,  only  3  (20  percent)  are 
definitely  detected,  8  (53  percent)  are  probably  detected,  while 
4  (27  percent)  went  definitely  undetected.  This  is  because 
these  faults  effect  the  instructions  that  the  processor  reads 
and  thus  would  alter  the  program  flow.  The  coverage  of  internal 
CPU  faults,  on  the  other  hand,  was  excellent,  with  92% 
definitely  detected  and  97%  probably  detected.  This  compares 
well  with  the  data  given  in  reference  8. 
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4.  SELF-TEST  HARDWARE  EXPERIMENTATION  AND  DOCUMENTATION 

The  hardware  added  to  the  microprocessor  system  £or  self¬ 
testing  was  kept  to  a  minimum.  The  hardware  consists  of  three 
basic  parts:  wraparound,  isolation,  and  control  logic  for  self¬ 
testing  I/O  ports;  timers  and  control  for  initiating  the  self¬ 
tests;  and  a  display  for  reporting  the  test  results.  In 
addition,  some  system  ROM  (1.5K)  is  required  to  store  the  self¬ 
test  routines  and  8  bytes  of  system  RAM  must  be  dedicated  to  the 
self-test.  Figure  4.1  shows  a  block  diagram  of  a  self-testing 
8080  system. 

4.1  Experimental  Verification  of  Self-Test  System 

The  self-test  described  in  Appendix  A  has  been  successfully 
verified  on  the  self-test  board.  A  "user"  program  was  run  in 
the  foreground  to  ensure  that  the  self-testing  did  not  interfere 
with  user  programs.  The  program  read  characters  from  the 
console  terminal  (through  the  8251) ,  echoed  them,  and  printed 
back  the  whole  line  of  text  when  a  carriage  return  was  typed. 
It  had  no  problems  executing — even  through  the  8251 
tests — despite  the  fact  that  self-test  passes  were  made  very  75 
ms  instead  of  about  once  a  second  as  would  probably  be  the  case 
in  practice. 

4.2  Status  Display 

The  self-test  displays  system  status  on  two  LEDs  and, 
optionally,  on  a  7-segment  display.  The  first  LED  represents 
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Indicates  logic  added  for  self-testing. 


NOT  ERROR,  it  is  normally  on  to  indicate  NO-ERROR  and  is 
extinguished  to  indicate  ERROR.  The  second  LED  is  a  "heartbeat" 
indicator.  It  is  toggled  on  and  off  by  successive  test  passes 
(or  by  every  nth  test  pass  if  n  passes  are  made  per  second)  so 
that  the  LED  blinks  on  and  off  about  once  per  second.  This 
provides  a  visual  indication  that  the  system  is  successfully 
self-testing  at  (about)  the  proper  rate.  Note  that  should 
either  LED  burn  out  an  error  condition  results.  The  LEDs  do,  of 
course,  require  monitoring.  Figure  4.2,  shows  the  LEDs  and  some 
of  the  driving  circuitry.  The  74373  8-bit  latch  is  used  as  a 
memory  mapped  output  port  (at  address  ADDR1) ;  a  one  or  zero 
(alternately)  is  written  to  control  bit  BO  at  the  end  of  each 
successful  test  pass  (or  each  n  passes)  to  make  the  "heartbeat" 
blink.  The  ERROR  signal  driving  the  ERROR  LED  is  generated  by 
logic  to  be  described  in  the  next  section  of  the  report. 

The  7-segment  display,  also  shown  in  Figure  2,  can  be 
included  to  allow  some  fault  location;  that  is,  different  codes 
are  written  to  the  display  by  different  tests  (CPU,  8255,  ROM, 
RAM,  8251)  so  that  a  fault  may  be  isolated  to  a  specific  element 
or  card.  Since  our  self-test  was  not  designed  for  fault 
diagnosis,  many  faults  in  one  module  are  detected  by  the  self¬ 
test  routine  for  a  different  module.  For  example,  a  memory 
fault  could  cause  the  CPU  memory  read/write  test  to  fail, 
indicating  a  bad  CPU  when  really  the  memory  is  at  fault.  The 
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Fiaure  4.2:  Test  Status  Displays. 


display  was  included  on  the  self-test  prototype  board  mostly  as 
a  development  aid,  but  can  be  incorporated  into  the  system  self¬ 
test  if  desired. 

Of  the  three  displays,  the  "heart-beat"  provides  the  best 
indication  that  the  system  is  up  and  running  correctly  because 
it  must  blink  on  and  off  (at  approximately  the  right  rate) . 
However,  certain  failures  in  the  self-test  hardware  could  cause 
loss  of  the  "heartbeat"  while  the  ERROR  LED  would  stay  lit 
(indicating  NO  ERROR) .  The  two  indicators  provide  a  measure  of 
redundancy  that  allows  detection  of  errors  in  the  self-test 
hardware  itself. 

4.3  Timers:  Interrupt  and  Timeout 

Figure  4.3  shows  the  counters  and  control  logic  needed  to 
generate  the  periodic  self-test  interrupt  calls  and  the  hardware 
timeout.  Note  that  an  8253  Programmable  Interval  Timer  provides 
the  two  counters  (with  one  spare) ;  the  counters  are  software 
controlled.  This  has  the  advantage  of  allowing  different  test 
cycle  times  for  different  passes  of  the  self-test  (an  8251  test 
pass,  for  example,  requires  more  time  than  a  ROM  test  pass) . 
The  disadvantage  is  that  the  system  must  function  correctly  to 
initialize  the  counters;  failure  to  do  so,  however,  will  be 
indicated  by  the  loss  of  the  "heartbeat”.  Both  timers  (0  &  1) 
are  configured  in  Mode  0  so  that  the  outputs,  initially  zero, 
will  change  to  one  and  stay  there  upon  the  terminal  count; 
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Figure  4.3:  Interrupt  &  Timeout  Control  Logic 


counting  will  then  be  suspended  until  a  new  start  value  is 
loaded . 

Timer  0  is  responsible  £or  generating  the  interrupt  request 
while  Timer  1  provides  the  hardware  timeout  feature.  The  8080 
loads  Timer  0  with  the  count  value  for  the  desired  time  between 
self-test  passes,  TQ,  and  loads  Timer  1  with  a  slightly  larger 
value,  T^  *  Tg  +  6  .  The  counters  are  started  simultaneously  by 
writing  ones  to  control  bits  CO  and  Cl  of  the  CNTL  latch  (at 
memory  mapped  address  ADDR3) ,  thus  enabling  the  Gate  inputs  on 
the  8253.  When  Timer  0  reaches  Tfl,  OUT  0  rises  from  zero  to 
one,  clocking  a  one  (CO)  through  F/F  #1  to  generate  the 
interrupt  request;  Timer  1  will  still  be  counting.  If  the  self¬ 
test  has  not  begun  within  time  6  after  TQ,  Timer  1  will  time 
out  and  generate  the  ERROR  condition  (latched  by  F/F  #2) .  Time  6 
is  the  maximum  time  needed  for  the  8080  to  process  the 
interrupt,  save  user  registers,  and  stop  Timer  1.  Thus  Timer 
l'a  first  function  is  to  ensure  that  the  self-test  is  initiated 
within  the  allotted  time. 

Upon  interrupt  acknowledge,  F/F  #1  is  cleared  and  an  RST 
instruction  is  gated  onto  the  Data  Bus  by  the  74244.  (The  74244 
may  be  omitted  if  RST7  is  used  for  the  self-test,  since  that 
opcode  is  FF  Hex.)  The  self-test  has  now  been  successfully 
initiated  and  zeroes  are  written  to  CNTL  bits  CO  and  Cl, 
disabling  the  timers.  Timer  1  is  now  loaded  with  a  new  count 
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value  corresponding  to  the  length  of  the  test  to  be  performed  on 
this  pass  (test  times  vary  depending  on  what  is  being  tested). 
A  one  is  then  written  to  CNTL  bit  Cl  to  start  this  timer.  Upon 
successful  completion  of  the  test  pass,  Timer  1  is  stopped  (by 
jwriting  a  zero  to  CNTL  bit  Cl) ,  Timers  0  and  1  are  reloaded  with 
Tq  and  T^,  respectively,  and  the  timers  are  started  (by  writing 
ones  to  CO  and  Cl)  to  await  the  next  test  pass.  If,  for  any 
reason,  the  self-test  does  not  finish  within  the  allotted  time 
interval.  Timer  1  will  time  out  and  generate  the  ERROR  signal. 
Thus  Timer  l's  second  function  is  to  ensure  the  self-test  pass 
reaches  a  timely  completion  (or  an  error  is  generated) . 

During  all  previous  write  operations  to  the  CNTL  latch 
(actually  writes  to  address  ADDR3) ,  bit  C2  was  a  logic  one.  If 
the  self-test  detects  a  fault,  a  zero  is  written  to  C2, 
presetting  F/F  #2  to  generate  the  ERROR  signal;  the  processor 
then  halts  (since  successful  return  of  control  to  the  user 
program  is  not  guaranteed) .  Thus  ERROR  may  be  generated  by 
either  a  hardware  timeout  (Timer  1)  or  by  software.  The  ERROR 
signal  turns  off  the  ERROR  LED  and  is  ava' lable  to  the  user  for 
any  other  desired  action.  Note  that  upon  power-up  the  ERROR 
signal  may  be  true  (indicating  ERROR)  for  a  short  while  before 
the  software  initializes  the  8253  and  CNTL  latch.  A  one-shot 
could  be  used  to  eliminate  this  possibility,  if  necessary. 
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The  hardware  shown  in  Figure  4.3  allows  complete  software 
control  of  the  self- testing  and  hardware  timeout.  This  allows  a 
user  program  to  suspend  self-testing  during  a  time-critical 
operation.  The  user  program  simply  writes  zeroes  to  CNTL  bits 
CO  and  Cl  (and  a  one  to  C2)  to  suspend  testing,  and  then  writes 
ones  to  CO,  Cl,  and  C2  to  resume  self- testing.  Note  that  the 
"heartbeat"  LED  will  be  affected  by  a  long  suspension,  so  that 
suspensions  for  over  100  ms  or  so  are  not  recommended.  Note 
also  that  if  the  user  program  fails  to  resume  self-testing,  then 
the  "heartbeat"  will  stop  altogether,  indicating  a  fault. 

The  "heartbeat"  also  minimizes  the  effect  of  a  fault  in  the 
hardware  of  Figure  4.3  or  in  the  software  control.  If  tests  are 
not  successfully  completed  at  (about)  the  proper  rate,  the 
"heartbeat"  will  indicate  a  fault  even  if  the  ERROR  LED  is  still 
lit. 

4.4  Hardware  Required  to  Self-Test  I/O  Ports 

Figures  4.4a  and  4.4b  illustrate  the  logic  needed  for  self¬ 
testing  parallel  and  serial  I/O  for  an  8080  system.  The  8255 
parallel  I/O  port  is  especially  easy  to  test  in  Mode  0  since 
each  of  the  three  ports  can  be  configured  as  either  input  or 
output;  this  allows  data  output  to  one  port  to  be  input  through 
another  port  of  the  same  chip.  Similarly,  the  8251  (being  a 
full  duplex  USART)  has  both  serial  input  and  serial  output  so 
that  another  UART  is  not  required  to  self- test  it. 
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Figure  4. A;  Self-Testing  I/O 


As  shown  in  Figure  4.4a,  the  self-test  logic  for  the  8255 
consists  of  three  (8-bit)  isolation  buffers  (11-13) ,  two 
bidirectional  (8-bit)  wraparound  buffers,  and  another  control 
latch,  memory  mapped  at  address  ADDR4 .  Buffers  II,  12',  and  13 
isolate  the  8255  from  its  peripheral  devices  during  self-testing 
of  the  8255.  Figure  4.5  shows  the  three  possible 
implementations  for  an  isolation  buffer.  In  Figure  4.5a,  the 
8255  port  is  configured  as  an  output  port;  the  74373  (octal  D- 
type  latch)  outputs  follow  the  inputs  (from  the  8255  port) 
during  normal  operation.  During  testing,  the  TESTING  signal 
goes  low  and  the  74373  latches  its  current  ouputs;  thus  the  user 
signals  are  preserved  during  the  test  and  the  peripheral  device 
never  sees  the  test  patterns.  The  8255  output  value  is  restored 
upon  successful  completion  of  the  test,  and  TESTING  is  set  high 
once  again  for  normal  operation.  The  TESTING  signal  is  supplied 
by  the  CNTL  latch  bit  X4  as  shown  in  Figure  4.4. 

In  Figure  4.5b,  the  8255  port  is  configured  as  an  input 
port;  now  the  74373  outputs  feed  the  peripheral  data  into  the 
8255  during  normal  operation.  During  testing,  the  TESTING 
signal  goes  high,  tri-stating  the  74373  outputs.  Thus  the 
peripheral  input  data  is  prevented  from  conflicting  with  test 
patterns.  Figure  4.5c  shows  a  special  case;  here  the  8255  port 
is  sometimes  used  as  an  input  port  and  sometimes  as  an  output 
port.  The  Y  signal  is  controlled  by  the  user  (through  a  latch- 
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Figure  4.6 


like  CNTL)-  to  define  the  direction  of  data  flow.  This  case  is 
merely  a  combination  of  the  first  two  cases.  During  testing, 
the  lefthand  74373  latches  its  data  (in  case  the  port  is  an 
output,  Y  »  1)  while  the  righthand  74373  is  tri-stated  (in  case 
the  port  is  an  input,  Y  *  0) . 

The  wraparound  buffers,  W1  and  W2,  are  74245’ s,  octal  bus 
transceivers  with  tri-state  outputs.  During  normal  operation, 
their  EN  inputs  (XO  and  X2)  are  high,  and  both  directions  have 
outputs  tri-stated.  During  testing,  CNTL  bits  XO  and  X2  are  set 
at  zero  and  bits  XI  and  X3  are  used  to  define  the  direction  of 
data  flow.  Thus  each  8255  port  can  be  tested  as  both  an  input 
port  and  output  port. 

The  serial  I/O  self-test  logic,  as  shown  in  Figure  4.4b, 
requires  two  tri-state  buffers  to  isolate  the  serial  peripheral 
device  and  one  more  tri-state  buffer  to  provide  wraparound 
(requiring  one  74125).  Only  one  control  bit  (X5)  is  required  to 
define  either  normal  operation  or  self-test  mode  (wraparound) . 
During  testing,  the  serial  input  is  connected  to  the  serial 
output  so  that  the  8251  receives  what  it  transmits;  the 
peripheral  device  is  isolated  by  the  tri-stated  buffers.  During 
normal  operation,  the  wraparound  buffer  is  tri-stated  and  the 
other  two  buffers  enabled  for  normal  serial  I/O. 

One  important  consideration  here  is  the  effect  of  a  fault 
in  the  isolation/  wraparound  hardware.  A  fault  in  a  wraparound 


buffer  would  be  detected  by  the  I/O  port's,  self-test.  However, 
a  fault  in  an  isolation  buffer  would  not  be  detected.  The 
isolation  can  be  tested,  but  an  additional  input  port  is 
required  and,  more  importantly,  the  testing  must  be  done  while 
writing  to  or  reading  from  the  peripheral  device.  This  requires 
knowledge  of  the  peripheral  device.  Figure  4.6  shows  an  example 
of  testing  parallel  I/O  isolation  buffers.  If  the  isolation 
buffers  passes  data  out  to  the  peripheral,  data  must  be  written 
to  the  8255,  input  through  the  extra  port  (ADDR5) ,  and  compared. 
If  the  isolation  buffer  passes  data  in  from  the  peripheral,  data 
must  be  read  through  both  the  8255  and  the  extra  port,  and 
compared.  Thus  data  from  both  sides  of  the  isolation  buffers  is 
compared.  For  serial  I/O,  an  extra  UART  would  replace  the  extra 
74373  parallel  input  port.  Again,  since  the  peripheral  will 
either  receive  or  provide  the  test  data,  this  testing  must  be 
part  of  the  applications  program. 
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5.  CONCLUSIONS 


The  main  conclusions  that  can  be  drawn  from  this  report 

are: 

(1)  It  is  possible  to  develop  efficient  self-test  routines 
for  detecting  faults  in  the  processor,  memory,  and  support  chip 
areas  of  a  microprocessor  system.  These  routines  comprise  the 
essential  element  of  a  total  self-test  strategy  for 
microprocessor  systems.  We  found  that  the  CPU  and  parallel  I/O 
port  tests  required  the  least  amount  of  execution  time,  in  fact 
both  of  these  tests  are  made  in  a  single  test  pass  in  2  ms, 
while  RAM  memory  testing  required  by  far  the  most  time,  approx. 
80  ms  for  IK.  ROM  testing  also  required  a  fair  amount  of  time, 
approx.  24  ms  for  IK.  These  figures  are  for  a  2MHz  clock  rate. 
Serial  I/O  testing  depends  almost  entirely  upon  the  baud  rate 
employed  as  opposed  to  the  other  tests  which  depend  on  the 
processor  clock  rate. 

Pault  injection  experiments  indicate  that  the  fault 
coverage  of  the  self-test  strategy  is  approximately  80%. 
Failures  detected  by  self-test  mechanisms  include  not  only  those 
detected  by  the  self-test  routines  directly,  but  also  those 
uncovered  by  "watch  dog”  timer  mechanisms.  This  second  category 
of  faults  is  characteristic  of  situations  in  which  the  system 
becomes  totally  unresponsive  and  when  the  self-test  hardware  is 
itself  faulty. 


(2)  A  chip  level  simulation  model  is  an  effective  tool  for 
evaluating  self- test  software.  This  model  was  used  to  construct 
fault  injection  experiments  in  order  to  assess  the  effectiveness 
of  the  self-test  software.  The  results  of  these  simulation 
experiments  were  used  to  calculate  the  80%  fault  coverage  figure 
mentioned  above. 

The  fact  that  the  model  was  constructed  and  was  used  to 
evaluate  self-test  software  constitutes  an  important 
contribution  to  the  state  of  the  art  in  system  validation.  To 
date,  accurate  modeling  and  simulation  of  LSI  devices  has  been 
prohibitively  expensive  in  many  validation  situations.  The  work 
carried  out  in  this  contract  has  demonstrated  the  effectiveness 
of  the  GSP  simulation  language  in  solving  this  problem. 

(3)  An  effective  self-testing  system  requires  only  a  small 
amount  of  self- test  hardware.  An  actual  8080  hardware  system 
was  constructed  and  put  into  full  working  order.  All  self-test 
routines  were  run  on  this  system  to  verify  that:  (a)  the  self¬ 
test  routines  will  actually  run  on  real  equipment  (b)  the  self¬ 
test  routines,  when  finished  with  their  execution,  leave  the 
system  in  a  state  compatible  with  an  operational  program  (c) 
that  the  small  amount  of  self-test  hardware  that  was  added, 
functioned  as  expected.  Our  laboratory  system  operation 
verified  that  all  three  of  these  requirements  were  satisfied. 


In  summary,  then,  we  feel  that  we  have  met  the  three  goals 
of  the  research  contract.  In  doing  so,  we  have  developed  an 
approach  to  the  self- test  of  microprocessor  systems  which  has 
been  demonstrated  as  being  effective.  In  addition  we  have 
accumulated  a  large  base  of  concepts  and  ideas  for  further 
important  research  in  the  areas  of  system  self-test  and  system 
modeling  and  simulation.  We  will  present  some  of  these  ideas  in 
the  next  section. 
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6.  RECOMMENDATIONS  FOR  FURTHER  RESEARCH 
As  was  emphasized  in  the  conclusion  section,  a  large  body 
of  important  knowledge  has  been  accumulated  in  completing  Air 
Force  Contract  F30602-80-C-0200.  In  light  of  this  we  make  the 
following  recommendations  for  further  research: 

Future  Study 

(1)  Develop  additional  self-test  library  programs  that 

provide  greater  fault  coverage.  The  logical  next  step  would  be 
to  develop  a  self-test  that  achieved  coverage  as  close  to  100% 
as  possible  without  imposing  any  time  constraints.  This  would 
provide  an  indication  of  the  time  required  for  such  a  test. 

This  report  describes  such  a  test  for  RAM  memory  that  requries 

approximately  20  seconds  to  test  IK  of  memory.  It  would  be 
useful  to  know  the  time  and  the  amount  of  added  hardware 

required  to  achieve  maximum  coverage  for  the  CPU  as  well.  Next 

it  would  be  useful  to  develop  a  set  of  programs  with 
intermediate  execution  times  and  fault  coverage.  The  system 
designer  could  then  select  the  self-test  that  best  suits  his 
needs.  The  tradeoffs  would  be  execution  time  and  added  hardware 
cost  for  additional  fault  coverage. 

(2)  Extension  of  the  self-test  techniques  to  other 
microprocessor  technologies.  The  self-techniques  that  were 
developed  were  applied  to  an  8080  system.  An  important 
extension  of  this  work  could  be  made  in  two  areas.  First,  self- 
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test  techniques  could  be  developed  for  microprocessor  systems 
which  possess  a  higher  level  of  integration.  A  first  step  here 
might  be  the  8085  system  which  combines  the  functions  of  the 
8080  processor  and  the  8228  and  8224  support  chips  into  one 
chip.  The  8085  has  essentially  the  same  instruction  set  as  the 
8080,  so  that  this  effort  would  constitute  a  rather  straight 
forward  extension  of  the  present  research  results.  Next,  self¬ 
test  techniques  could  be  developed  for  a  full  microcomputer  on  a 
chip,  such  as  the  Motorola  6802.  These  chips  extend  the  level 
of  integration  present  in  the  8085  by  having  both  RAM  and  ROM 
memory  in  the  chip.  The  obvious  cost  and  reliability  advantage 
of  such  chips  will  dictate  their  use  in  avionics  systems  and  it 
is  important  that  self-test  techniques  be  developed  for  these 
chip  types  also.  The  second  possible  area  of  extension,  could 
be  to  16-bit  microprocessors  such  as  the  8086,  MC68000,  and  the 
Z8000.  The  greater  computational  power  and  accuracy  of  these 
chips  will  no  doubt  result  in  their  extensive  use  in  avionics 
designs  and  self-test  techniques  should  be  developed  for  them. 

(3)  Abstract  the  features  of  the  various  library  programs, 
possibly  using  a  branch  of  formal  mathematics,  that  would  allow 
the  tradeoff  to  be  defined  in  general  terms  applicable  to 
variety  of  microprocessor  systems. 

(4)  Development  of  simulation  models  for  other 
microprocessor  technologies.  This  effort  would  support  the  work 
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in  (2)  by  allowing  fault  simulations  to  be  done  foe  these  other 
microprocessor  technologies  as  well. 

(5)  Development  of  systematic  approaches  to  modeling  of 
both  good  and  faulty  LSI  devices.  We  now  have  in  place,  a 
complete,  chip  level  model  of  a  microprocessor  system.  Such  a 
resource  offers  great  opportunity  for  exploring  various 
approaches  to  the  modeling  of  good  and  faulty  LSI  devices. 
Information  gained  in  such  a  study,  plus  that  gained  in  the 
current  contract  F30602-80-C-0200  should  allow  us  to  develop 
systematic  approaches  to  this  modeling. 
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BCQ  #0,«2,CUC0N  ; I F  PORT  A  IS  MODE  0  ,  CONTINUE  PROCESSING. 

BEQ  #1,«2,CUCON  ; 

BRU  NEX8  OTHERWISE,  TERMINATE  TRANSFER  TO  PORT  C  UPPER 

M0V(W2)  CUI.CU  ; SCHEDULE  A  TRANSFER  TO  PORT  C  UPPER  IN  50  NS. 
BMC  NRD, NEX8  ; I F  RD=1,  TERMINATE  THE  DATA  TRANSFER. 
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APPENDIX  S 

Fault  Experiments  Summary 


CHIP:  8080  CFO 


FAULT  LIST 


1 

|  FAOLT  DESCRIPTION 

i 

i. 

TBST  ISSOLT 

1 

.1 

COBH KITS 

» 

1 

J _ 

1 Detected  t  Prog ran |  lot  | 

|  I Control | oetectedl 

J _ i  Lost  t  I 

IBultiple  register  select I  I  1  | 

|on  BBAD.  Select  0  also  1*1  1  1 

l  select  B _ |  I  i  1 

IBegister  C  bit  3 

uaasfcafci _ _ _ _ _ 

1 

• 

1 

_ 1 _ 

1 

J _ 

1 

J _ 

stuck-at-1 


CHA  always  sets  bit  2  of 
of  Accua  . 


|IB  poise  duration  too  till 
| short  (about  half  of  j  *  j  1  1 
inoa.  value)  1  l  I  l 

I Parity  flag  deterain-  till 

lotion  ignores  bit  3.  |  *  |  |  I 

| Parity  flag  deterain-  1  1  1  1 
lotion  ignores  bit  3.  j  *  |  j  I 
l Treats  it  as  stuck -at-g  i  III 

ISTIC  pulse  is  delayed 
(till  about  the  falling 
ledue  of  82  clock 

1 

I 

1 

1 

| Fault  had  no  effect  on  the 
•  | system  per for nance. 

1 

1 

| Data  Line  D3, stuck-et-1 

1 

|  • 

1 

1 

I Hardware  tiaer  would 
j Probably  detect  the  fault 
« 

IData  line  stuck-at-0 

* 

I 

1 

l 

1 

I Beset  pin  open 

I  (stuck-et-1) 

l 

* 

1 

l-  - 

1 

1 

1 

|8080  CPU  does  not  function 
| hardware  tiaer  should 

1  detect  the  fault  _ 

I Interrupt  pin  open 

I (stuck-at-1) 

1 

1 

1 

i 

* 

1 

1 

1 

1 

1 

l  . 

1 

1 

1 

1 

1 

| 

| Results  in  RST7  which 
| causes  a  call  to  address 
1803811.  The  test  prograa 

I incidentally,  starts  at 
|the  sane  location.  Txaer 

1 detected 

| Incorrect  register 

I select  on  BBAD  &  IBZTB 

1 f select  H  selects  8) 

• 

— 

1 

I 

l 

1 

1 

| 

1 

1 

1 

I Incorrect  register 
j select  on  BBAD  8  IBITB 

* 

« 

1 

i 

1 

1 

i 

1 

1 

l 

IBultiple  register  select 
jon  write  (Vrite  B  also 
UlilBB-ta  Cl _ 

♦ 

1 

1 

1 

1 

1 

1 

• 

B.  2 


CHIP:  8228 


FAULT  LIST 


FAULT  DESCRIPTION 


Blocks  data  out  froa 
8080  by  floating  bus 


| BUSH  input  shorted  to 
ground 


BOSBN  open  (stuck-at-1) 


OBXB  input  (stuck-at-0) 


TEST  RESULT 


Detected 


Prograa 

Control 

-hasi—. 


Mot  | 
Detected! 


conn ents 


* 


* 


(Detected  by  CPI  ?4H  at 
1 7SH 

_ _ 

| Bus  is  never  disabled 

I 

_ I _ 

*  |Bus  disabled 
I 


| Hardware  tiaer  should 
(detect  the  fault. 

I _ 


DBIB  input  open 
(stuck-at-1) 


Data  line  2  froa  8080 
open 


E, 


CHIP:  BUS 


FAULT  LIST 


E.  5 


CHIPS  Mg 


FAULT  LIST 


1 

I  FAULT  DESCBIPTIOM 

1 

1 

TEST  RESULT 

i 

i  counts 

1 

1 

1 

I  Detected | Prog ran |  Hot  | 

|  j Controll Detected | 

J _ 1  Lost  1  1 

Kidran  line  AD2 
|stuck-et-p 

1 

1 

1 

1  1 

1  1 

* 

l 

I 

liddncs  lin*  AD2 
|stuck-at-1 

1 

1 

1 

1  1 

1  1 

• 

i 

l 

I Decoder  in  RAH  ignores  | 

|nost  significant  address | 

|bit.  Only  loner  half  of  | 
InenorT  can  be  accessed _ 1 

1  1 

1  1 

1  1 

* 

|Teat  inooaplete 
| Hardware  tiner  should 
| detect  the  fault. 

|Oata  line  D1 
jstuck-et-Rf 

1 

1 

1 

1  i 

1  *  1 

1 

(Data  line  01 
jstuck-at-1 

1 

1 

1 

1  1 

1  *  1 

1 

|Data  bit  3  stuck-at-p 

1 

1 

|  * 

1 

i  i 

lAccuaulator  contains  piH 
| instead  of  PA AH 

|0ata  line  3  stuck-at-1 

1 

1 

1 

1  « 
l 

i  i 

i  i 

i  i 

|Test  inooaplete 
j Hardware  tiner  should 

1 detect  the  fault _ 

1  1  1  1  1 

1  1  1  1  1 

1  1  III 

1  till 

1  till 

1  1  1  1  I 

1  till 

1  1  1  1  1 

1  1.  .....  1.  ...  1  1 

1  1  1  1  1 

1  till 

1  till 

1  1  1  1  1 

1  1  1  1  1 

1  1  1  I  I  _  _ 

1  1  1  1  1 

1  1  1  1  1 

1  1  1  1  1 

1  till 

1  1  III 

1  1  1  1  1 

1  1  1  1  1 

1  1111 

E. 


FAULT  DESCRIPTION 


Program  Not 
Control  Detected 
Lost 


HR  input  open 
(stuck-at-1) 


CS  input  open 
(stuck-at-1) 


does  not  respond  to 
read  or  write  commands. 
Date  bus  to  Hi-Z  state 


n  a  data  read,  data  re¬ 
mains  stable  for  only 
100NS  after  it  is  gated 
onto  the  bus 


Write  pulse  requires  to 
be  500NS  long  instead  of 
2  SONS 


oth  mode  word  and  com¬ 
mand  word  are  loaded  in¬ 
to  the  command  register. 


utput  counter 
stuck-at-all  l's 


E.9 


8255 


FAOLT  LIST 


FAULT  LIST 


CHIP:  8255 


FAULT  DESCRIPTION 


output  driver  in  the 
8255  fails.  Bit 
stuck-at-1 


Port  B  (input) 
stuck-at-0 


ad  port  A  operation 
fails  (Data  buffer  does 
not  get  loaded  frost 
rt  A) 


react  operation  always 
fails  (Data  bus  tri- 
stated  all  the  time) 


test  program  does  not  test 
using  the  pattern  FF  H 


FAULT  LIST 


CHIP:  8255 


FAULT  DESCRIPTION 

TiEST  RESULT 

COMMENTS 

Detected 

Program 

Control 

Lost 

Not 

Detected 

Port  B  (input)  bits  4  a 

5  shorted 

* 

Address  pin  stuck-at-0 
(A*) 

* 

Address  pin  stuck-at-f 
(A1> 

* 

short  between  address 
pins  A^  a  ax 

* 

WR  stuck-at-? 

* 

WR  open 

* 

* 

RD  open 
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MOVI  RAM  Test  Program  Listing 


INVERSIONS  TEST  PATTERN 


*  *  *  *  * 
♦  *  *  *  ♦ 
*  *  *  *  * 


o 

(/> 


*  *  *  *  * 
*  *  *  *  * 
♦***♦ 

* 

* 

* 

* 

* 

* 

* 


******** 

******** 

******** 


5 

OS 


u. 

O 

h* 

V) 

X 

o 

</) 

MZ 

o 

w 

3 

5 

t- 

> 

Z> 

w 

—  CO 


\  o  * 

:  wc 

u.  CO 

CU.U.U.TU. 

ooo<o 

oc  OS 

Q  UJ  CC  UJ  LJ 
OKOh  I  h- 

<>o>  > 

CO  <  CO  oco 

y~  z 

KZOZUZ 

<uzczo 

I  - UJ  —  <  — 

(AZwXKZ 

II  II  II  II  II  II 

O  O  N 

UJZZZ-Z 
CO  CD  WUJ</)N 


s 

5 


O  w 


►  mm  » 

>ce  * 

£  i 


*  *  *  *  * 
*  *  *  *  * 
*  *  *  *  * 


******** 

******** 


********** 
********** 
********** 
*  * 

*  * 

*  * 


i-  * 

z  * 

uj  * 

X  * 

UJ  * 

OS  * 

g  ! 

V*  H  * 

£  A  | 

I 

ii  * 

oc  * 

UJ  * 

H-  * 

U)  * 

o  * 

Ul  * 

OS  * 


UJ  UJ  O 

oei- 

MZZOZO 
zzzz-z 
O  UJ  UJ  —  o  3 
</)*-»-  O.  O 

-hi-w  o: 

flS<<<0>-< 

<Q.a.  wo: 

0.  KQQ. 
Z30QZ< 
OUJ  -JOUJCC 

ozo<z5 


UJ-J 

<flOOxw 


******** 

******** 

******** 

* 


<  o 
wo  uj 

(AffiZUh 

<  -COO 

►—  os  w 

OWDJH 

U3QJIU 

-o 

V)  w 

—  o-si-oe 
=>  <o 
asosooos 
w  os  —  OS 
*-  w  zw 


o 

o  ar  000  or  a 

r-  W  W  W  W  W  W 


{********* 
********* 


**•*•**! 

mum 


F.  1. 


*0*0  MACRO  ASSEMBLER,  VER  2.4 
ERRORS  =  0  PAGE  6 


APPENDIX  G 


Th«  following  is  a  list  of  the  micro-operations  determined  for  th« 
8080  CPO  based  on  the  clock  cycle  by  clock  cycle  breakdown  of  each 
instruction  <4  ,  pp.  2-16  to  2-20)  and  the  CPO  functional  block 

diagram  <4  ,  p .  2-2) - 


Key: 

r8 

Any  8-bit  register  of  the  register  array 

r16 

Any  16-bit  register  pair  of  the  register 

ACT 

Accumulator  Latch 

A 

Accumulator 

CT 

Carry  flag 

THP 

Temp,  register 

Dbus 

8-bit  data  bus 

Abus 

16— bit  address  bus 

8080  Hicro-operations : 

1)  rl6  =  Abus 

2)  r16a  ♦  1  *  r16b 

3)  Dbus  a  THP  and  IB 

4)  r8  *  TUP 

5)  A  =  TAP 

6)  THP  *  r8 

7)  THP  ■  A 

8)  Dbus  *  r8 

9)  Dbus  *  A 

10)  Dbus  *  THP 

11)  THP  *  Dbus 

12)  A  *  Dbus 

13)  r8  *  Dbus 

14)  (Ht)  »  (DE)  [  XCHG  ] 

15)  r16a  *  r16b 

16)  A  *  ACT 

17)  r8  *  ACT 

18)  ACT  ♦  THP  =  ALO  [i.e.  outputs] 

19)  ACT  ♦  THP  ♦  CT  *  ALtJ 

20)  ACT  -  THP  =  ALO 

21)  ACT  -  THP  -  CT  *  ALO 

22)  THP  ♦  1  *  ALU 

23)  THP  -  1  *  ALO 

24)  ALO  *  r8 

25)  ALO  «  A 

26)  ALO  -  Dbus 

27)  r16a  -  1  *  r16b 

28)  DAA  *  A,  flags  [decimal  adjust] 

29)  ACT  AND  THP  *  ALU 

30)  ACT  OB  THP  -  ALU 

31)  ACT  XOB  THP  «  ALO 

32)  ALO  *  flags  S#  Z,  P  S  AC 

33)  ALO  -  CT 

34)  CT  -  ALO 

35)  A  -  ALO 


36) 

Rotate 

Bight 

37) 

Botate 

Bight  through  CT 

38) 

Botata 

Left 

39) 

Botata 

Left  through  CT 

80) 

HOT  A  - 

k 

81) 

ROT  Cl 

«  CT 

82) 

1  *  CT 

83) 

Judge  Condition 

48) 

00  <  1 

reg  . 

85) 

Flags  » 

Dbus 

86) 

Dbus  * 

Flags 

87) 

set  IRTE  F/F 

88) 

Beset  IRTE  F/F 

89) 

Halt  Node 

50) 

Status: 

instruction  Fetch 

51) 

Status: 

neaory  Bead 

52) 

Status: 

Meaory  Brite 

53) 

Status: 

Stack  Read 

54) 

Status: 

Stack  Write 

55) 

Status: 

1H  Head 

56) 

Status: 

OUT  write 

57) 

Status: 

interrupt  Acknowledge 

58) 

Status: 

Halt  Acknowledge 

59) 

Status: 

Interrupt  Ack.  while 

60) 

Dbus  * 

r16high  and  r161ow 

APPENDIX  H 


100 


110 


120 

400 

500 


1000 

1010 

1020 

1030 

1040 


1050 

2000 

2005 

2010 


2020 

2030 

2040 

2050 


2060 

2070 

2100 

9999 


10000 


10010 

10020 


/  CHKSUM  —  CALCULATE  CHECKSUMS  FOR  AN  OBJECT  FILE 
/  IN  SEGMENTS  OF  A  DESIRED  LENGTH. 

/  THE  SUN  IS  FORMED  USING  A  MODULO  256  ADD  KITH  CARET 

/  OUTS  ADDED  BACK  INTO  LSB. 

/ 

/  THE  SEGMENT  LENGTHS  AND  DESIRED  FINAL  CHECKSUM 

/  ABE  SELECTED  BY  THE  USER. 

/ 

/  DAVID  HAtSLKTT  MICROPROCESSOR  SELF-TEST  PROJECT 

/ 

HEX0$  =  "01 23456769 ABCDEF" 

DEF  PNH*(D$)  ■  (INSTR  ( 1 , HEXOS , LEFTS  (D$, 1) ) -1) *16  ♦ 

INSTH(1, HEXOS, MID* (DS, 2,1)  )  -1 
/  RETURN  INTEGER  VALUE  OF  2  DIGIT  HEX  STRING 
/ 

PRINT  CHR$(  10) -."CHKSUM  -  VO  1  .01";CHR*  (10) 

PRINT  "INPUT  FILE";  :  INPUT  PIL*  : 

IF  INSTR (1, FILS, ".")=0  THEN  FILS=FIL$*" .HEX- 
OPEN  "I",  »1,  FILS 

PRINT  "ROM  SEGMENT  SIZE";  :  INPOT  ROMSS*  : 

IF  ROMS S%<3  THEN  PRINT  "?IN VALID  SIZE:  "{ROHSS*  l  GOTO  1030 
PRINT  "DESIRED  FINAL  SUM";  J  INPUT  DSUM*  { 

IF  DSUH*<0  OR  DSUH4>255  THEN  PRINT  "TOUT  OF  RANGE,  ENTER  0-255" 
GOTO  1040 

HLINES  =  ""  !  CSUM't  =  0 

FOR  B*  =  1  TO  ROMSS*  S  GOSUB  10000  : 

IF  OP*  =  -1  THEN  IF  M  =  1  THEN  2100  ELSE  2030 
ADDRL*=ADdR*  :  IF  U*=1  THEN  ADDh1*=ADDR* 

CS0M*=CSUM4  ♦  Up*  : 

ZX=CSUH A  AND  (NOT  255)  :  CSUMS-CSUM*  AND  255; 

IF  Z*  THEN  CSUM%*CSUH%-*1 
NEXT  B% 

KSUH*=DSU  M%— CSUM‘4  : 

IF  RSUMACO  THliN  r< ;><IM%*-RS0MA— 1 
«SUM*=RSU»1*  AND  2:*5 

PRINT  "CHECKSUM  FO«  SEGMENT  "{EIGHTS ("000"*HEX$ (ADDRl*) ,4) ; 

"H  TO  RIGHT*  ("000"*HKA$ (ADDRL*) ,4)  ;»H  IS 
RIGHTS  ("0"»!lr.XI  (RSUH*)  ,2)  ;"H" 

CSUH*— 0 

IF  OP'.O-l  THsN  2000 
CLOSE  1  ;  GOTO  J27b7 

/  RT.AD  AN  OF.1KCT  CODE  BYTE  FROM  HEA  FILE  6 

/  RETURN  IT  IN  OP* 

IF  HLINES!*""  THEN  LINE  INPUT  #1,  H$  :  HS*H1DS (HS,2)  : 

IF  MIDS(M*,1,  1)0";" 

THEN  100UD  ELSE  HRf TKS%*PNH% (HID* (HS,2,2) )  J 
APDRO?.ill%(.1lD.I  (Hi, 4, 2)  )  *256  ♦  FNH*  (HID*  (H*,6 ,2)  )  { 

POA*- 1  ;  rtLINES*.lID*  (H*,10,2*MBYTF.*)  ;  IF  HBYTE*«0  THEN  OP*»-1s 
OP*»FNH;,(HLlNcS3)  ;  OPS*LKPTJ  (IILINE$,2)  : 

I|LINK**MIdS  (rtl.INI  J,  J) 

IF  FO*  TH  .h  FU*»0  ELSE  ADD.I**ADDR%*  1 


H.l. 


RETURN 


Appendix  I 


RADC  Microprocessor  Self-Test  Project 
Hardware  System  Documentation 

The  self- test  system  consists  of  sn  8080  CPU,  8228  system 
controller,  2  8251  serial  I/O  ports,  an  8255  parallel  I/O  port,  8253 
programmable  interval  timer  (with  3  independent  timers),  2  8-bit  data 
latches  for  various  control  functions,  2K  of  ROM  containing  the  system 
monitor,  and  4K  of  RAM.  The  system  employs  memory  mapped  I/O  and  thus 
does  not  use  IN  or  OUT  instructions.  The  system  memory  map  is  shown 
below: 


Addresa  (Hex) 

0000  -  07FF 

0800  -  17FF 

3C24 

3C25 


3C28 

3C2C 

3C2D 

3C30 

3C38 

3C39 

3C3A 

3C3B 

3C3C 

3C3D 

3C3S 

3C3F 


Assignment 
ROM  (monitor) 

System  RAM 

Down-line  load  8251,  data  port 
Down- line  load  8251,  command  port 

CNTIil:  8-bit  latch;  see  below 

Console  8251,  data  port 
Console  8251,  command  port 

CNTL2:  8-bit  latch;  see  below 

8253  Timer  0  (interrupt) 

8253  Timer  1  (timeout) 

8253  Timer  2  (unused) 

8253  Control 

8255  Port  A 
8255  Port  B 
8255  Port  C 
8255  Control 


1.1. 


The  8253  Timer  0  is  used  to  generate  the  interrupt  that  initiates 
the  periodic  self- test.  This  timer  should  be  configured  for  Mode  0 
since  the  interrupt  is  generated  on  the  rising  edge  of  Output  0.  A 
RST  3  is  executed  upon  interrupt  acknowledge,  and  control  is  passed  to 
RAM  location  0A00H.  Timer  1  is  used  to  generate  a  hardware  timeout; 
this  occurs  if  the  self-test  is  not  initiated  or  is  not  completed  in 
its  allotted  time.  Timer  1  should  be  configured  for  Mode  0,  since  its 
output  must  go  high  and  stay  high  for  the  timeout.  This  causes  the 
ERR-bar  LED  to  go  out  (indicating  error).  Timer  2  is  unused  and  thus 
available  to  the  user.  The  Timer  0  and  1  Gate  inputs  are  controlled 
by  the  CNTL2  latch  (3C30H);  this  latch  is  also  responsible  for 
enabling  or  disabling  the  hardware  timeout  (see  below).  Both  Timers  0 
and  1  are  driven  by  the  processor  clock  (.89  MHz). 

The  CNTL1  8-bit  latch  (1C  22)  is  responsible  for  controlling  the 
baud  rates  of  both  8251' s;  it  also  controls  the  console  8251 
wraparound  (self-test)  logic  and  drives  the  'heartbeat'  LED.  Its  bits 
have  the  following  meanings: 

§H(s)  Function 

0  Low  connects  console  8251  to  the  console  terminal; 

High  wraps  serial  output  to  serial  input. 

1-3  Console  8251  baud  rate  control  (see  below). 

4  Controls  the  'heartbeat'  LED:  low  «  ON;  high  =  OFF. 

5-7  Down- line  load  8251  baud  rate  control  (see  below). 


1.2. 


Assuming  the  8251' s  are  programmed  for  16x  operation 


the  baud 


rate  control  is  defined  as  follows: 

Bit:  3  2  1  --  console 

7  6  5  "-  down-line  load 


000  Do  MOT  use 

001  19200  baud 

010  9600  baud 

011  4800  baud 

100  2400  baud 

101  1200  baud 

110  600  baud 

111  300  baud 


The  CNTL2  8-bit  latch  (IC  17)  is  responsible  for  controlling  the 
8255  wraparound  self-test  logic,  the  8253  Counters  0  &  1  gate  inputs, 
and  for  enabling/disabling  the  hardware  timeout.  Its  bits  have  the 
following  functions: 

Bit  Function 

0  8253  Gate  0  (Timer  0) 

1  8253  Gate  1  (Timer  1) 

2  High  allows  hardware  timeout; 

Low  forces  the  timeout. 

3  High  disables  hardware  timeout; 

Low  enables  it. 

4  Low  enables  8255  Port  A  wraparound  logic; 

High  disables  it  (&  tri-states  Port  A). 

5  Low  sets  8255  Port  A  wraparound  INTO  Port  A; 

High  sets  wraparound  OUT  OF  Port  A. 

6  Low  enables  8255  Port  C  wraparound  logic; 

High  disables  it  (&  tri-states  Fort  C). 

7  Low  sets  8255  Port  C  wraparound  INTO  Port  C; 

High  sets  wraparound  OUT  OF  Port  C. 


* 


1.3. 


Note  that  Bit  5  is  meaningless  if  Bit  4  is  1,  and  Bit  7  is 


meaningless  if  Bit  6  is  1. 

To  enable  a  hardware  timeout  (Timer  1),  Bits  2  and  3  should  be  1 
and  0,  respectively.  To  indicate  an  error  (fault  detected).  Bits  2 
and  3  should  both  be  set  to  0;  this  forces  a  'timeout'  and  turns  off 
the  ERR-bar  LED. 

The  system's  7-segment  display  is  connected  to  the  8255' s  Port  B; 
if  Port  B  is  configured  as  an  output,  then  Port  B  is  used  to  drive  the 
display.  When  Port  B  is  configured  as  an  input.  Port  A  or  Port  C  may 
be  used  to  drive  the  display  via  the  wraparound  logic.  Note  that  low 
bits  light  segments,  while  high  bits  turn  segments  off. 


1.4. 


V 

•  < 


